/*      $OpenBSD: npppd_auth.c,v 1.23 2024/02/26 10:42:05 yasuoka Exp $ */

/*-
 * Copyright (c) 2009 Internet Initiative Japan Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
/**@file authentication realm */
/* $Id: npppd_auth.c,v 1.23 2024/02/26 10:42:05 yasuoka Exp $ */
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <net/if_dl.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <syslog.h>
#include <string.h>
#include <time.h>
#include <event.h>
#include <stdarg.h>
#include <stdlib.h>
#include <netdb.h>
#include <errno.h>

#include "debugutil.h"
#include "npppd_local.h"
#include "npppd_auth.h"
#include "net_utils.h"

#include "npppd_auth_local.h"
#include "npppd_radius.h"

/**
 * Create a npppd_auth_base object.
 * @param auth_type     the authentication type.
 *      specify {@link ::NPPPD_AUTH_TYPE_LOCAL} to authenticate by the local
 *      file, or specify {@link ::NPPPD_AUTH_TYPE_RADIUS} for RADIUS
 *      authentication.
 * @param name          the configuration name
 * @param _npppd        the parent {@link ::npppd} object
 * @see ::NPPPD_AUTH_TYPE_LOCAL
 * @see ::NPPPD_AUTH_TYPE_RADIUS
 * @return The pointer to the {@link ::npppd_auth_base} object will be returned
 * in case success otherwise NULL will be returned.
 */
npppd_auth_base *
npppd_auth_create(int auth_type, const char *name, void *_npppd)
{
        npppd_auth_base *base;

        NPPPD_AUTH_ASSERT(name != NULL);

        switch (auth_type) {
        case NPPPD_AUTH_TYPE_LOCAL:
                if ((base = calloc(1, sizeof(npppd_auth_local))) != NULL) {
                        base->type = NPPPD_AUTH_TYPE_LOCAL;
                        strlcpy(base->name, name, sizeof(base->name));
                        base->npppd = _npppd;

                        return base;
                }
                break;

#ifdef USE_NPPPD_RADIUS
        case NPPPD_AUTH_TYPE_RADIUS:
                if ((base = calloc(1, sizeof(npppd_auth_radius))) != NULL) {
                        npppd_auth_radius *_this = (npppd_auth_radius *)base;
                        base->type = NPPPD_AUTH_TYPE_RADIUS;
                        strlcpy(base->name, name, sizeof(base->name));
                        base->npppd = _npppd;
                        if ((_this->rad_auth_setting =
                            radius_req_setting_create()) == NULL)
                                goto radius_fail;
                        if ((_this->rad_acct_setting =
                            radius_req_setting_create()) == NULL)
                                goto radius_fail;

                        return base;
radius_fail:
                        if (_this->rad_auth_setting != NULL)
                                radius_req_setting_destroy(
                                    _this->rad_auth_setting);
                        if (_this->rad_acct_setting != NULL)
                                radius_req_setting_destroy(
                                    _this->rad_acct_setting);
                        free(base);
                        return NULL;
                }

                break;
#endif

        default:
                NPPPD_AUTH_ASSERT(0);
                break;
        }

        return NULL;
}

/**
 * Call this function to make the object unusable.
 * <p>
 * {@link ::npppd_auth_base} objects is referred by the {@link ::npppd_ppp}
 * object.   After this function is called, npppd will disconnect the PPP
 * links that refers the object, it will call {@link ::npppd_auth_destroy()}
 * when all the references to the object are released.</p>
 */
void
npppd_auth_dispose(npppd_auth_base *base)
{

        base->disposing = 1;

        return;
}

/** Destroy the {@link ::npppd_auth_base} object.  */
void
npppd_auth_destroy(npppd_auth_base *base)
{

        if (base->disposing == 0)
                npppd_auth_dispose(base);

        npppd_auth_base_log(base, LOG_INFO, "Finalized");

        switch(base->type) {
        case NPPPD_AUTH_TYPE_LOCAL:
                memset(base, 0, sizeof(npppd_auth_local));
                break;

#ifdef USE_NPPPD_RADIUS
        case NPPPD_AUTH_TYPE_RADIUS:
            {
                npppd_auth_radius *_this = (npppd_auth_radius *)base;
                if (_this->rad_auth_setting != NULL)
                        radius_req_setting_destroy(_this->rad_auth_setting);
                _this->rad_auth_setting = NULL;
                if (_this->rad_acct_setting != NULL)
                        radius_req_setting_destroy(_this->rad_acct_setting);
                _this->rad_acct_setting = NULL;
                memset(base, 0, sizeof(npppd_auth_local));
                break;
            }
#endif
        }
        free(base);

        return;
}

/** Reload the configuration */
int
npppd_auth_reload(npppd_auth_base *base)
{
        struct authconf *auth;

        TAILQ_FOREACH(auth, &base->npppd->conf.authconfs, entry) {
                if (strcmp(auth->name, base->name) == 0)
                        break;
        }
        if (auth == NULL)
                return 1;

        base->pppsuffix[0] = '\0';
        if (auth->username_suffix != NULL)
                strlcpy(base->pppsuffix, auth->username_suffix,
                    sizeof(base->pppsuffix));
        base->eap_capable = auth->eap_capable;
        base->strip_nt_domain = auth->strip_nt_domain;
        base->strip_atmark_realm = auth->strip_atmark_realm;
        base->has_users_file = 0;
        base->radius_ready = 0;
        base->user_max_session = auth->user_max_session;

        if (strlen(auth->users_file_path) > 0) {
                strlcpy(base->users_file_path, auth->users_file_path,
                    sizeof(base->users_file_path));
                base->has_users_file = 1;
        } else {
                if (base->type == NPPPD_AUTH_TYPE_LOCAL) {
                        npppd_auth_base_log(base,
                            LOG_WARNING, "missing users_file property.");
                        goto fail;
                }
        }

        switch (base->type) {
#ifdef USE_NPPPD_RADIUS
        case NPPPD_AUTH_TYPE_RADIUS:
                if (npppd_auth_radius_reload(base, auth) != 0)
                        goto fail;
                break;
#endif
        }
        base->initialized = 1;

        return 0;

fail:
        base->initialized = 0;
        base->has_users_file = 0;
        base->radius_ready = 0;

        return 1;
}

/**
 * This function gets specified user's password. The value 0 is returned
 * if the call succeeds.
 *
 * @param       username        username which gets the password
 * @param       password        buffers which stores the password
 *                              Specify NULL if you want to known the length of
 *                              the password only.
 * @param       lppassword      pointer which indicates the length of
 *                              the buffer which stores the password.
 * @return A value 1 is returned if user is unknown. A value 2 is returned
 *                              if password buffer is sufficient. A negative value is
 *                              returned if other error occurred.
 */
int
npppd_auth_get_user_password(npppd_auth_base *base,
    const char *username, char *password, int *plpassword)
{
        int              retval, sz, lpassword;
        npppd_auth_user *user;

        NPPPD_AUTH_ASSERT(base != NULL);
        NPPPD_AUTH_DBG((base, LOG_DEBUG, "%s(%s)", __func__, username));

        user = NULL;
        retval = 0;
        if (base->has_users_file == 0) {
                retval = -1;
                goto out;
        }
        if ((user = npppd_auth_get_user(base, username)) == NULL) {
                retval = 1;
                goto out;
        }
        if (password == NULL && plpassword == NULL) {
                retval = 0;
                goto out;
        }
        if (plpassword == NULL) {
                retval = -1;
                goto out;
        }
        lpassword = strlen(user->password) + 1;
        sz = *plpassword;
        *plpassword = lpassword;
        if (password == NULL) {
                retval = 0;
                goto out;
        }
        if (sz < lpassword) {
                retval = 2;
                goto out;
        }
        strlcpy(password, user->password, sz);
out:
        free(user);

        return retval;
}

/**
 * This function gets specified users' Framed-IP-{Address,Netmask}.
 * The value 0 is returned if the call succeeds.
 * <p>
 * Because authentication database is updated at any time, the password is
 * possible to be inconsistent if this function is not called immediately
 * after authentication. So this function is called immediately after
 * authentication. </p>
 * @param       username        username which gets the password
 * @param       ip4address      pointer which indicates struct in_addr which
 *                                              stores the Framed-IP-Address
 * @param       ip4netmask      pointer which indicates struct in_addr which
 *                                              stores Framed-IP-Netmask
 */
int
npppd_auth_get_framed_ip(npppd_auth_base *base, const char *username,
    struct in_addr *ip4address, struct in_addr *ip4netmask)
{
        npppd_auth_user *user;

        NPPPD_AUTH_ASSERT(base != NULL);
        NPPPD_AUTH_DBG((base, LOG_DEBUG, "%s(%s)", __func__, username));
        if (base->has_users_file == 0)
                return -1;

        if ((user = npppd_auth_get_user(base, username)) == NULL)
                return 1;

        if (user->framed_ip_address.s_addr != 0) {
                *ip4address = user->framed_ip_address;
                if (ip4netmask != NULL)
                        *ip4netmask = user->framed_ip_netmask;

                free(user);
                return 0;
        }
        free(user);

        return 1;
}

/**
 * Retribute "Calling-Number" attribute of the user from the realm.
 *
 * @param username      Username.
 * @param number        Pointer to the space for the Calling-Number.  This
 *      can be NULL in case retributing the Calling-Number only.
 * @param plnumber      Pointer to the length of the space for the
 *      Calling-Number.
 * @return 0 if the Calling-Number attribute is successfully retributed.
 *      1 if the user has no Calling-Number attribute.  return -1 if the realm
 *      doesn't have user attributes or other errors.   return 2 if the space
 *      is not enough.
 */
int
npppd_auth_get_calling_number(npppd_auth_base *base, const char *username,
    char *number, int *plnumber)
{
        int              retval, lcallnum, sz;
        npppd_auth_user *user;

        user = NULL;
        retval = 0;
        if (base->has_users_file == 0)
                return -1;

        if ((user = npppd_auth_get_user(base, username)) == NULL)
                return 1;

        if (number == NULL && plnumber == NULL) {
                retval = 0;
                goto out;
        }
        if (plnumber == NULL) {
                retval = -1;
                goto out;
        }
        lcallnum = strlen(user->calling_number) + 1;
        sz = *plnumber;
        *plnumber = lcallnum;
        if (sz < lcallnum) {
                retval = 2;
                goto out;
        }
        strlcpy(number, user->calling_number, sz);

out:
        free(user);

        return retval;
}

int
npppd_auth_get_type(npppd_auth_base *base)
{
        return base->type;
}

int
npppd_auth_is_usable(npppd_auth_base *base)
{
        return (base->initialized != 0 && base->disposing == 0)? 1 : 0;
}

int
npppd_auth_is_ready(npppd_auth_base *base)
{
        if (!npppd_auth_is_usable(base))
                return 0;

        switch(base->type) {
        case NPPPD_AUTH_TYPE_LOCAL:
                return (base->has_users_file)? 1 : 0;
                /* NOTREACHED */

        case NPPPD_AUTH_TYPE_RADIUS:
                return (base->has_users_file != 0 ||
                    base->radius_ready != 0)? 1 : 0;
                /* NOTREACHED */
        }
        NPPPD_AUTH_ASSERT(0);

        return 0;
}

int
npppd_auth_is_disposing(npppd_auth_base *base)
{
        return (base->disposing != 0)? 1 : 0;
}

int
npppd_auth_is_eap_capable(npppd_auth_base *base)
{
        return (base->eap_capable != 0)? 1 : 0;
}

const char *
npppd_auth_get_name(npppd_auth_base *base)
{
        return base->name;
}

const char *
npppd_auth_get_suffix(npppd_auth_base *base)
{
        return base->pppsuffix;
}

const char *
npppd_auth_username_for_auth(npppd_auth_base *base, const char *username,
    char *username_buffer)
{
        const char *u0;
        char *atmark, *u1;

        u0 = NULL;
        if (base->strip_nt_domain != 0) {
                if ((u0 = strchr(username, '\\')) != NULL)
                        u0++;
        }
        if (u0 == NULL)
                u0 = username;
        u1 = username_buffer;
        if (username_buffer != u0)
                memmove(username_buffer, u0, MINIMUM(strlen(u0) + 1,
                    MAX_USERNAME_LENGTH));
        if (base->strip_atmark_realm != 0) {
                if ((atmark = strrchr(u1, '@')) != NULL)
                        *atmark = '\0';
        }

        return username_buffer;
}

int
npppd_auth_user_session_unlimited(npppd_auth_base *_this)
{
        return (_this->user_max_session == 0) ? 1 : 0;
}

int
npppd_check_auth_user_max_session(npppd_auth_base *_this, int count)
{
        if (!npppd_auth_user_session_unlimited(_this) &&
            _this->user_max_session <= count)
                return 1;
        else
                return 0;
}

/***********************************************************************
 * Account list related functions
 ***********************************************************************/
static npppd_auth_user *
npppd_auth_get_user(npppd_auth_base *base, const char *username)
{
        int              lsuffix, lusername;
        const char      *un;
        char             buf[MAX_USERNAME_LENGTH];
        npppd_auth_user *u;

        un = username;
        lsuffix = strlen(base->pppsuffix);
        lusername = strlen(username);
        if (lsuffix > 0 && lusername > lsuffix &&
            strcmp(username + lusername - lsuffix, base->pppsuffix) == 0 &&
            lusername - lsuffix < sizeof(buf)) {
                memcpy(buf, username, lusername - lsuffix);
                buf[lusername - lsuffix] = '\0';
                un = buf;
        }
        
        if (priv_get_user_info(base->users_file_path, un, &u) == 0)
                return u;

        return NULL;
}

#ifdef USE_NPPPD_RADIUS
/***********************************************************************
 * RADIUS
 ***********************************************************************/
/** reload the configuration of RADIUS authentication realm */
static int
npppd_auth_radius_reload(npppd_auth_base *base, struct authconf *auth)
{
        npppd_auth_radius  *_this = (npppd_auth_radius *)base;
        radius_req_setting *rad;
        struct radserver   *server;
        int                 i, nauth, nacct;

        _this->rad_auth_setting->timeout =
            (auth->data.radius.auth.timeout == 0)
                    ? DEFAULT_RADIUS_TIMEOUT : auth->data.radius.auth.timeout;
        _this->rad_acct_setting->timeout =
            (auth->data.radius.acct.timeout == 0)
                    ? DEFAULT_RADIUS_TIMEOUT : auth->data.radius.acct.timeout;


        _this->rad_auth_setting->max_tries =
            (auth->data.radius.auth.max_tries == 0)
                    ? DEFAULT_RADIUS_MAX_TRIES : auth->data.radius.auth.max_tries;
        _this->rad_acct_setting->max_tries =
            (auth->data.radius.acct.max_tries == 0)
                    ? DEFAULT_RADIUS_MAX_TRIES : auth->data.radius.acct.max_tries;

        _this->rad_auth_setting->max_failovers =
            (auth->data.radius.auth.max_failovers == 0)
                    ? DEFAULT_RADIUS_MAX_FAILOVERS
                    : auth->data.radius.auth.max_failovers;
        _this->rad_acct_setting->max_failovers =
            (auth->data.radius.acct.max_failovers == 0)
                    ? DEFAULT_RADIUS_MAX_FAILOVERS
                    : auth->data.radius.acct.max_failovers;

        _this->rad_acct_setting->curr_server = 
        _this->rad_auth_setting->curr_server = 0;

        /* load configs for authentication server */
        rad = _this->rad_auth_setting;
        for (i = 0; i < countof(rad->server); i++)
                memset(&rad->server[i], 0, sizeof(rad->server[0]));
        i = 0;
        TAILQ_FOREACH(server, &auth->data.radius.auth.servers, entry) {
                if (i >= countof(rad->server))
                        break;
                memcpy(&rad->server[i].peer, &server->address,
                    server->address.ss_len);
                if (((struct sockaddr_in *)&rad->server[i].peer)->sin_port
                    == 0)
                        ((struct sockaddr_in *)&rad->server[i].peer)->sin_port
                            = htons(DEFAULT_RADIUS_AUTH_PORT);
                strlcpy(rad->server[i].secret, server->secret,
                    sizeof(rad->server[i].secret));
                rad->server[i].enabled = 1;
                i++;
        }
        nauth = i;

        /* load configs for accounting server */
        rad = _this->rad_acct_setting;
        for (i = 0; i < countof(rad->server); i++)
                memset(&rad->server[i], 0, sizeof(rad->server[0]));
        i = 0;
        TAILQ_FOREACH(server, &auth->data.radius.acct.servers, entry) {
                if (i >= countof(rad->server))
                        break;
                memcpy(&rad->server[i].peer, &server->address,
                    server->address.ss_len);
                if (((struct sockaddr_in *)&rad->server[i].peer)->sin_port
                    == 0)
                        ((struct sockaddr_in *)&rad->server[i].peer)->sin_port
                            = htons(DEFAULT_RADIUS_ACCT_PORT);
                strlcpy(rad->server[i].secret, server->secret,
                    sizeof(rad->server[i].secret));
                rad->server[i].enabled = 1;
                i++;
        }
        nacct = i;

        for (i = 0; i < countof(_this->rad_auth_setting->server); i++) {
                if (_this->rad_auth_setting->server[i].enabled)
                        base->radius_ready = 1;
        }

        npppd_auth_base_log(&_this->nar_base, LOG_INFO,
            "Loaded configuration.  %d authentication server%s, %d accounting "
            "server%s.",
            nauth, (nauth > 1)? "s" : "", nacct, (nacct > 1)? "s" : "");

        if (nacct > 0 && _this->rad_acct_on == 0) {
                radius_acct_on(base->npppd, _this->rad_acct_setting);
                _this->rad_acct_on = 1;
        }

        return 0;
}

/**
 * Get {@link ::radius_req_setting} for RADIUS authentication of specified
 * {@link ::npppd_auth_base} object.
 */
void *
npppd_auth_radius_get_radius_auth_setting(npppd_auth_radius *_this)
{
        return _this->rad_auth_setting;
}

/**
 * Get {@link ::radius_req_setting} for RADIUS accounting of specified
 * {@link ::npppd_auth_base} object.
 */
void *
npppd_auth_radius_get_radius_acct_setting(npppd_auth_radius *_this)
{
        return _this->rad_acct_setting;
}

#endif

/***********************************************************************
 * Helper functions
 ***********************************************************************/
/** Log it which starts the label based on this instance. */
static int
npppd_auth_base_log(npppd_auth_base *_this, int prio, const char *fmt, ...)
{
        int status;
        char logbuf[BUFSIZ];
        va_list ap;

        NPPPD_AUTH_ASSERT(_this != NULL);
        va_start(ap, fmt);
        snprintf(logbuf, sizeof(logbuf), "realm name=%s %s",
            _this->name, fmt);
        status = vlog_printf(prio, logbuf, ap);
        va_end(ap);

        return status;
}