/*      $OpenBSD: radiusd_file.c,v 1.8 2024/11/21 13:43:10 claudio Exp $        */

/*
 * Copyright (c) 2024 YASUOKA Masahiko <yasuoka@yasuoka.net>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <sys/cdefs.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <netinet/in.h>

#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <imsg.h>
#include <limits.h>
#include <md5.h>
#include <radius.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "chap_ms.h"
#include "imsg_subr.h"
#include "log.h"
#include "radiusd.h"
#include "radiusd_module.h"

struct module_file_params {
        int                      debug;
        char                     path[PATH_MAX];
};

struct module_file {
        struct module_base      *base;
        struct imsgbuf           ibuf;
        struct module_file_params
                                 params;
};

struct module_file_userinfo {
        struct in_addr          frame_ip_address;
        char                    password[0];
};

/* IPC between priv and main */
enum {
        IMSG_RADIUSD_FILE_OK = 1000,
        IMSG_RADIUSD_FILE_NG,
        IMSG_RADIUSD_FILE_PARAMS,
        IMSG_RADIUSD_FILE_USERINFO
};

static void      parent_dispatch_main(struct module_file_params *,
                    struct imsgbuf *, struct imsg *);
static void      module_file_main(void) __dead;
static pid_t     start_child(char *, int);
static void      module_file_config_set(void *, const char *, int,
                    char * const *);
static void      module_file_start(void *);
static void      module_file_access_request(void *, u_int, const u_char *,
                    size_t);
static void      auth_pap(struct module_file *, u_int, RADIUS_PACKET *, char *,
                    struct module_file_userinfo *);
static void      auth_md5chap(struct module_file *, u_int, RADIUS_PACKET *,
                    char *, struct module_file_userinfo *);
static void      auth_mschapv2(struct module_file *, u_int, RADIUS_PACKET *,
                    char *, struct module_file_userinfo *);
static void      auth_reject(struct module_file *, u_int, RADIUS_PACKET *,
                    char *, struct module_file_userinfo *);

static struct module_handlers module_file_handlers = {
        .access_request         = module_file_access_request,
        .config_set             = module_file_config_set,
        .start                  = module_file_start
};

int
main(int argc, char *argv[])
{
        int                              ch, pairsock[2], status;
        pid_t                            pid;
        char                            *saved_argv0;
        struct imsgbuf                   ibuf;
        struct imsg                      imsg;
        ssize_t                          n;
        size_t                           datalen;
        struct module_file_params       *paramsp, params;
        char                             pathdb[PATH_MAX];

        while ((ch = getopt(argc, argv, "M")) != -1)
                switch (ch) {
                case 'M':
                        module_file_main();
                        /* not reached */
                        break;
                }
        saved_argv0 = argv[0];

        argc -= optind;
        argv += optind;

        if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, PF_UNSPEC,
            pairsock) == -1)
                err(EXIT_FAILURE, "socketpair");

        log_init(0);

        pid = start_child(saved_argv0, pairsock[1]);

        /* Privileged process */
        if (pledge("stdio rpath unveil", NULL) == -1)
                err(EXIT_FAILURE, "pledge");
        setproctitle("[priv]");
        if (imsgbuf_init(&ibuf, pairsock[0]) == -1)
                err(EXIT_FAILURE, "imsgbuf_init");

        /* Receive parameters from the main process. */
        if (imsg_sync_read(&ibuf, 2000) <= 0 ||
            (n = imsg_get(&ibuf, &imsg)) <= 0)
                exit(EXIT_FAILURE);
        if (imsg.hdr.type != IMSG_RADIUSD_FILE_PARAMS)
                err(EXIT_FAILURE, "Receieved unknown message type %d",
                    imsg.hdr.type);
        datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
        if (datalen < sizeof(params))
                err(EXIT_FAILURE, "Receieved IMSG_RADIUSD_FILE_PARAMS "
                    "message is wrong size");
        paramsp = imsg.data;
        if (paramsp->path[0] != '\0') {
                strlcpy(pathdb, paramsp->path, sizeof(pathdb));
                strlcat(pathdb, ".db", sizeof(pathdb));
                if (unveil(paramsp->path, "r") == -1 ||
                    unveil(pathdb, "r") == -1)
                        err(EXIT_FAILURE, "unveil");
        }
        if (paramsp->debug)
                log_init(1);

        if (unveil(NULL, NULL) == -1)
                err(EXIT_FAILURE, "unveil");

        memcpy(&params, paramsp, sizeof(params));

        for (;;) {
                if (imsgbuf_read(&ibuf) != 1)
                        break;
                for (;;) {
                        if ((n = imsg_get(&ibuf, &imsg)) == -1)
                                break;
                        if (n == 0)
                                break;
                        parent_dispatch_main(&params, &ibuf, &imsg);
                        imsg_free(&imsg);
                        imsgbuf_flush(&ibuf);
                }
                imsgbuf_flush(&ibuf);
        }
        imsgbuf_clear(&ibuf);

        while (waitpid(pid, &status, 0) == -1) {
                if (errno != EINTR)
                        break;
        }
        exit(WEXITSTATUS(status));
}

void
parent_dispatch_main(struct module_file_params *params, struct imsgbuf *ibuf,
    struct imsg *imsg)
{
        size_t                           datalen, entsz, passz;
        const char                      *username;
        char                            *buf, *db[2], *str;
        int                              ret;
        struct module_file_userinfo     *ent;

        datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
        switch (imsg->hdr.type) {
        case IMSG_RADIUSD_FILE_USERINFO:
                if (datalen == 0 ||
                    *((char *)imsg->data + datalen - 1) != '\0') {
                        log_warn("%s: received IMSG_RADIUSD_FILE_USERINFO "
                            "is wrong", __func__);
                        goto on_error;
                }
                username = imsg->data;
                db[0] = params->path;
                db[1] = NULL;
                if ((ret = cgetent(&buf, db, username)) < 0) {
                        log_info("user `%s' is not configured", username);
                        goto on_error;
                }
                if ((ret = cgetstr(buf, "password", &str)) < 0) {
                        log_info("password for `%s' is not configured",
                            username);
                        goto on_error;
                }
                passz = strlen(str) + 1;
                entsz = offsetof(struct module_file_userinfo, password[passz]);
                if ((ent = calloc(1, entsz)) == NULL) {
                        log_warn("%s; calloc", __func__);
                        goto on_error;
                }
                strlcpy(ent->password, str, passz);
                imsg_compose(ibuf, IMSG_RADIUSD_FILE_USERINFO, 0, -1, -1,
                    ent, entsz);
                freezero(ent, entsz);
                break;
        }
        return;
 on_error:
        imsg_compose(ibuf, IMSG_RADIUSD_FILE_NG, 0, -1, -1, NULL, 0);
}

/* main process */
void
module_file_main(void)
{
        struct module_file       module_file;

        setproctitle("[main]");

        memset(&module_file, 0, sizeof(module_file));
        if ((module_file.base = module_create(STDIN_FILENO, &module_file,
            &module_file_handlers)) == NULL)
                err(1, "Could not create a module instance");

        module_drop_privilege(module_file.base, 0);

        module_load(module_file.base);
        if (imsgbuf_init(&module_file.ibuf, 3) == -1)
                err(EXIT_FAILURE, "imsgbuf_init");

        if (pledge("stdio", NULL) == -1)
                err(EXIT_FAILURE, "pledge");
        while (module_run(module_file.base) == 0)
                ;

        module_destroy(module_file.base);

        exit(0);
}

pid_t
start_child(char *argv0, int fd)
{
        char *argv[5];
        int argc = 0;
        pid_t pid;

        switch (pid = fork()) {
        case -1:
                fatal("cannot fork");
        case 0:
                break;
        default:
                close(fd);
                return (pid);
        }

        if (fd != 3) {
                if (dup2(fd, 3) == -1)
                        fatal("cannot setup imsg fd");
        } else if (fcntl(fd, F_SETFD, 0) == -1)
                fatal("cannot setup imsg fd");

        argv[argc++] = argv0;
        argv[argc++] = "-M";    /* main proc */
        argv[argc++] = NULL;
        execvp(argv0, argv);
        fatal("execvp");
}

void
module_file_config_set(void *ctx, const char *name, int valc,
    char * const * valv)
{
        struct module_file      *module = ctx;
        char                    *errmsg;

        if (strcmp(name, "path") == 0) {
                SYNTAX_ASSERT(valc == 1, "`path' must have a argument");
                if (strlcpy(module->params.path, valv[0], sizeof(
                    module->params.path)) >= sizeof(module->params.path)) {
                        module_send_message(module->base, IMSG_NG,
                            "`path' is too long");
                        return;
                }
                module_send_message(module->base, IMSG_OK, NULL);
        } else if (strcmp(name, "_debug") == 0) {
                log_init(1);
                module->params.debug = 1;
                module_send_message(module->base, IMSG_OK, NULL);
        } else if (strncmp(name, "_", 1) == 0)
                /* ignore all internal messages */
                module_send_message(module->base, IMSG_OK, NULL);
        else
                module_send_message(module->base, IMSG_NG,
                    "Unknown config parameter `%s'", name);
        return;
 syntax_error:
        module_send_message(module->base, IMSG_NG, "%s", errmsg);
        return;
}

void
module_file_start(void *ctx)
{
        struct module_file      *module = ctx;

        /* Send parameters to parent */
        if (module->params.path[0] == '\0') {
                module_send_message(module->base, IMSG_NG,
                    "`path' is not configured");
                return;
        }
        imsg_compose(&module->ibuf, IMSG_RADIUSD_FILE_PARAMS, 0, -1, -1,
            &module->params, sizeof(module->params));
        imsgbuf_flush(&module->ibuf);

        module_send_message(module->base, IMSG_OK, NULL);
}

void
module_file_access_request(void *ctx, u_int query_id, const u_char *pkt,
    size_t pktlen)
{
        size_t                           datalen;
        struct module_file              *self = ctx;
        RADIUS_PACKET                   *radpkt = NULL;
        char                             username[256];
        ssize_t                          n;
        struct imsg                      imsg;
        struct module_file_userinfo     *ent;

        memset(&imsg, 0, sizeof(imsg));

        if ((radpkt = radius_convert_packet(pkt, pktlen)) == NULL) {
                log_warn("%s: radius_convert_packet()", __func__);
                goto out;
        }
        radius_get_string_attr(radpkt, RADIUS_TYPE_USER_NAME, username,
            sizeof(username));

        imsg_compose(&self->ibuf, IMSG_RADIUSD_FILE_USERINFO, 0, -1, -1,
            username, strlen(username) + 1);
        imsgbuf_flush(&self->ibuf);
        if (imsgbuf_read(&self->ibuf) != 1) {
                log_warn("%s: imsgbuf_read()", __func__);
                goto out;
        }
        if ((n = imsg_get(&self->ibuf, &imsg)) <= 0) {
                log_warn("%s: imsg_get()", __func__);
                goto out;
        }

        datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
        if (imsg.hdr.type == IMSG_RADIUSD_FILE_USERINFO) {
                if (datalen <= offsetof(struct module_file_userinfo,
                    password[0])) {
                        log_warn("%s: received IMSG_RADIUSD_FILE_USERINFO is "
                            "invalid", __func__);
                        goto out;
                }
                ent = imsg.data;
                if (radius_has_attr(radpkt, RADIUS_TYPE_USER_PASSWORD))
                        auth_pap(self, query_id, radpkt, username, ent);
                else if (radius_has_attr(radpkt, RADIUS_TYPE_CHAP_PASSWORD))
                        auth_md5chap(self, query_id, radpkt, username, ent);
                else if (radius_has_vs_attr(radpkt, RADIUS_VENDOR_MICROSOFT,
                    RADIUS_VTYPE_MS_CHAP2_RESPONSE))
                        auth_mschapv2(self, query_id, radpkt, username, ent);
                else
                        auth_reject(self, query_id, radpkt, username, ent);
        } else
                auth_reject(self, query_id, radpkt, username, NULL);
 out:
        if (radpkt != NULL)
                radius_delete_packet(radpkt);
        imsg_free(&imsg);
        return;
}

void
auth_pap(struct module_file *self, u_int q_id, RADIUS_PACKET *radpkt,
    char *username, struct module_file_userinfo *ent)
{
        RADIUS_PACKET   *respkt = NULL;
        char             pass[256];
        int              ret;

        if (radius_get_string_attr(radpkt, RADIUS_TYPE_USER_PASSWORD, pass,
            sizeof(pass)) != 0) {
                log_warnx("%s: radius_get_string_attr", __func__);
                return;
        }
        ret = strcmp(ent->password, pass);
        explicit_bzero(ent->password, strlen(ent->password));
        log_info("q=%u User `%s' authentication %s (PAP)", q_id, username,
            (ret == 0)? "succeeded" : "failed");
        if ((respkt = radius_new_response_packet((ret == 0)?
            RADIUS_CODE_ACCESS_ACCEPT : RADIUS_CODE_ACCESS_REJECT, radpkt))
            == NULL) {
                log_warn("%s: radius_new_response_packet()", __func__);
                return;
        }
        module_accsreq_answer(self->base, q_id,
            radius_get_data(respkt), radius_get_length(respkt));
        radius_delete_packet(respkt);
}

void
auth_md5chap(struct module_file *self, u_int q_id, RADIUS_PACKET *radpkt,
    char *username, struct module_file_userinfo *ent)
{
        RADIUS_PACKET   *respkt = NULL;
        size_t           attrlen, challlen;
        u_char           chall[256], idpass[17], digest[16];
        int              ret;
        MD5_CTX          md5;

        attrlen = sizeof(idpass);
        if (radius_get_raw_attr(radpkt, RADIUS_TYPE_CHAP_PASSWORD, idpass,
            &attrlen) != 0) {
                log_warnx("%s: radius_get_string_attr", __func__);
                return;
        }
        challlen = sizeof(chall);
        if (radius_get_raw_attr(radpkt, RADIUS_TYPE_CHAP_CHALLENGE, chall,
            &challlen) != 0) {
                log_warnx("%s: radius_get_string_attr", __func__);
                return;
        }
        MD5Init(&md5);
        MD5Update(&md5, idpass, 1);
        MD5Update(&md5, ent->password, strlen(ent->password));
        MD5Update(&md5, chall, challlen);
        MD5Final(digest, &md5);

        ret = timingsafe_bcmp(idpass + 1, digest, sizeof(digest));
        log_info("q=%u User `%s' authentication %s (CHAP)", q_id, username,
            (ret == 0)? "succeeded" : "failed");
        if ((respkt = radius_new_response_packet((ret == 0)?
            RADIUS_CODE_ACCESS_ACCEPT : RADIUS_CODE_ACCESS_REJECT, radpkt))
            == NULL) {
                log_warn("%s: radius_new_response_packet()", __func__);
                return;
        }
        module_accsreq_answer(self->base, q_id,
            radius_get_data(respkt), radius_get_length(respkt));
        radius_delete_packet(respkt);
}

void
auth_mschapv2(struct module_file *self, u_int q_id, RADIUS_PACKET *radpkt,
    char *username, struct module_file_userinfo *ent)
{
        RADIUS_PACKET           *respkt = NULL;
        size_t                   attrlen;
        int                      i, lpass;
        char                    *pass = NULL;
        uint8_t                  chall[MSCHAPV2_CHALLENGE_SZ];
        uint8_t                  ntresponse[24], authenticator[16];
        uint8_t                  pwhash[16], pwhash2[16], master[64];
        struct {
                uint8_t          salt[2];
                uint8_t          len;
                uint8_t          key[16];
                uint8_t          pad[15];
        } __packed               rcvkey, sndkey;
        struct {
                uint8_t          ident;
                uint8_t          flags;
                uint8_t          peerchall[16];
                uint8_t          reserved[8];
                uint8_t          ntresponse[24];
        } __packed               resp;
        struct authresp {
                uint8_t          ident;
                uint8_t          authresp[42];
        } __packed               authresp;


        attrlen = sizeof(chall);
        if (radius_get_vs_raw_attr(radpkt, RADIUS_VENDOR_MICROSOFT,
            RADIUS_VTYPE_MS_CHAP_CHALLENGE, chall, &attrlen) != 0) {
                log_info("q=%u failed to retribute MS-CHAP-Challenge", q_id);
                goto on_error;
        }
        attrlen = sizeof(resp);
        if (radius_get_vs_raw_attr(radpkt, RADIUS_VENDOR_MICROSOFT,
            RADIUS_VTYPE_MS_CHAP2_RESPONSE, &resp, &attrlen) != 0) {
                log_info("q=%u failed to retribute MS-CHAP2-Response", q_id);
                goto on_error;
        }

        /* convert the password to UTF16-LE */
        lpass = strlen(ent->password);
        if ((pass = calloc(1, lpass * 2)) == NULL) {
                log_warn("%s: calloc()", __func__);
                goto on_error;
        }
        for (i = 0; i < lpass; i++) {
                pass[i * 2] = ent->password[i];
                pass[i * 2 + 1] = '\0';
        }

        /* calculate NT-Response by the password */
        mschap_nt_response(chall, resp.peerchall,
            username, strlen(username), pass, lpass * 2, ntresponse);

        if (timingsafe_bcmp(ntresponse, resp.ntresponse, 24) != 0) {
                log_info("q=%u User `%s' authentication failed (MSCHAPv2)",
                    q_id, username);
                if ((respkt = radius_new_response_packet(
                    RADIUS_CODE_ACCESS_REJECT, radpkt)) == NULL) {
                        log_warn("%s: radius_new_response_packet()", __func__);
                        goto on_error;
                }
                authresp.ident = resp.ident;
                strlcpy(authresp.authresp, "E=691 R=0 V=3",
                    sizeof(authresp.authresp));
                radius_put_vs_raw_attr(respkt, RADIUS_VENDOR_MICROSOFT,
                    RADIUS_VTYPE_MS_CHAP_ERROR, &authresp,
                    offsetof(struct authresp, authresp[13]));
        } else {
                log_info("q=%u User `%s' authentication succeeded (MSCHAPv2)",
                    q_id, username);
                if ((respkt = radius_new_response_packet(
                    RADIUS_CODE_ACCESS_ACCEPT, radpkt)) == NULL) {
                        log_warn("%s: radius_new_response_packet()", __func__);
                        goto on_error;
                }
                mschap_auth_response(pass, lpass * 2, ntresponse, chall,
                    resp.peerchall, username, strlen(username),
                    authresp.authresp);
                authresp.ident = resp.ident;

                radius_put_vs_raw_attr(respkt, RADIUS_VENDOR_MICROSOFT,
                    RADIUS_VTYPE_MS_CHAP2_SUCCESS, &authresp,
                    offsetof(struct authresp, authresp[42]));

                mschap_ntpassword_hash(pass, lpass * 2, pwhash);
                mschap_ntpassword_hash(pwhash, sizeof(pwhash), pwhash2);
                mschap_masterkey(pwhash2, ntresponse, master);
                radius_get_authenticator(radpkt, authenticator);

                /* MS-MPPE-Recv-Key  */
                memset(&rcvkey, 0, sizeof(rcvkey));
                arc4random_buf(rcvkey.salt, sizeof(rcvkey.salt));
                rcvkey.salt[0] |= 0x80;
                rcvkey.len = 16;
                mschap_asymetric_startkey(master, rcvkey.key, 16, 0, 1);
                radius_put_vs_raw_attr(respkt, RADIUS_VENDOR_MICROSOFT,
                    RADIUS_VTYPE_MPPE_RECV_KEY, &rcvkey, sizeof(rcvkey));

                /* MS-MPPE-Send-Key  */
                memset(&sndkey, 0, sizeof(sndkey));
                arc4random_buf(sndkey.salt, sizeof(sndkey.salt));
                sndkey.salt[0] |= 0x80;
                sndkey.len = 16;
                mschap_asymetric_startkey(master, sndkey.key, 16, 1, 1);
                radius_put_vs_raw_attr(respkt, RADIUS_VENDOR_MICROSOFT,
                    RADIUS_VTYPE_MPPE_SEND_KEY, &sndkey, sizeof(sndkey));
        }

        module_accsreq_answer(self->base, q_id,
            radius_get_data(respkt), radius_get_length(respkt));
 on_error:
        /* bzero password */
        explicit_bzero(ent->password, strlen(ent->password));
        if (pass != NULL)
                explicit_bzero(pass, lpass * 2);
        free(pass);
        if (respkt != NULL)
                radius_delete_packet(respkt);
}

void
auth_reject(struct module_file *self, u_int q_id, RADIUS_PACKET *radpkt,
    char *username, struct module_file_userinfo *ent)
{
        RADIUS_PACKET   *respkt = NULL;

        if (ent != NULL)
                explicit_bzero(ent->password, strlen(ent->password));

        log_info("q=%u User `%s' authentication failed", q_id,
            username);
        if ((respkt = radius_new_response_packet(RADIUS_CODE_ACCESS_REJECT,
            radpkt)) == NULL) {
                log_warn("%s: radius_new_response_packet()", __func__);
                return;
        }
        module_accsreq_answer(self->base, q_id,
            radius_get_data(respkt), radius_get_length(respkt));
        radius_delete_packet(respkt);
}