/*
 * $OpenBSD: login_ldap.c,v 1.3 2021/09/02 20:57:58 deraadt Exp $
 * Copyright (c) 2002 Institute for Open Systems Technology Australia (IFOST)
 * Copyright (c) 2007 Michael Erdely <merdely@openbsd.org>
 * Copyright (c) 2019 Martijn van Duren <martijn@openbsd.org>
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
 * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/time.h>
#include <sys/resource.h>
#include <netinet/in.h>

#include <errno.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <limits.h>
#include <unistd.h>
#include <login_cap.h>
#include <stdarg.h>
#include <bsd_auth.h>

#include "aldap.h"
#include "login_ldap.h"

int     auth_ldap(char *, char *, char *);
__dead void usage(void);

static void
handler(int signo)
{
        _exit(1);
}

/*
 * Authenticate a user using LDAP
 */

int
main(int argc, char **argv)
{
        int c;
        char *class, *service, *username, *password;
        char backbuf[BUFSIZ];
        FILE *back = NULL;

        password = class = NULL;
        service = LOGIN_DEFSERVICE;

        (void)signal(SIGQUIT, SIG_IGN);
        (void)signal(SIGINT, SIG_IGN);
        (void)signal(SIGALRM, handler);
        (void)setpriority(PRIO_PROCESS, 0, 0);

        openlog("login_ldap", LOG_ODELAY, LOG_AUTH);

        /*
         * Usage: login_xxx [-s service] [-v var] user [class]
         */
        while ((c = getopt(argc, argv, "ds:v:")) != -1) {
                switch(c) {
                case 'd':
                        back = stdout;
                        debug = 1;
                        break;
                case 'v':
                        /* For compatibility */
                        break;
                case 's':       /* service */
                        service = optarg;
                        if (strcmp(service, "login") != 0 &&
                                strcmp(service, "challenge") != 0 &&
                                strcmp(service, "response") != 0) {
                                        dlog(0, "%s not supported", service);
                                        return 1;
                                }
                        break;
                default:
                        usage();
                }
        }

        argc -= optind;
        argv += optind;

        switch (argc) {
        case 2:
                class = argv[1];
                /* FALLTHROUGH */
        case 1:
                username = argv[0];
                break;
        default:
                usage();
        }

        if (strlen(username) >= LOGIN_NAME_MAX) {
                dlog(0, "username too long");
                return 1;
        }

        /*
         * Filedes 3 is the back channel, where we send back results.
         */
        if (back == NULL && (back = fdopen(3, "a")) == NULL)  {
                dlog(0, "error reopening back channel");
                return 1;
        }

        if (strcmp(service, "login") == 0) {
                password = getpass("Password: ");
        } else if (strcmp(service, "response") == 0) {
                int n;

                /*
                 * format of back channel message
                 *
                 * c h a l l e n g e \0 p a s s w o r d \0
                 *
                 * challenge can be NULL (so can password too
                 * i suppose).
                 */

                n = read(3, backbuf, sizeof(backbuf));
                if (n == -1) {
                        dlog(0, "read error from back channel");
                        return 1;
                }

                /* null challenge */
                if (backbuf[0] == '\0')
                        password = backbuf + 1;
                /* skip the first string to get the password */
                else if ((password = strchr(backbuf, '\0')) != NULL)
                        password++;
                else
                        dlog(0, "protocol error on back channel");

        } else if (strcmp(service, "challenge") == 0) {
                (void)fprintf(back, BI_SILENT "\n");
                return 0;
        }

        if (password == NULL || password[0] == '\0') {
                dlog(1, "No password specified");
                (void)fprintf(back, BI_REJECT "\n");
                return 1;
        }

        if (auth_ldap(username, class, password))
                (void)fprintf(back, BI_AUTH "\n");
        else
                (void)fprintf(back, BI_REJECT "\n");

        explicit_bzero(password, strlen(password));

        closelog();

        return 0;
}

int
auth_ldap(char *user, char *class, char *pass)
{
        struct auth_ctx ctx;
        const char *cfile = NULL;
        char *tmp;
        login_cap_t     *lc;

        memset(&ctx, 0, sizeof(struct auth_ctx));
        TAILQ_INIT(&(ctx.s));

        if ((lc = login_getclass(class)) != NULL) {
                cfile = login_getcapstr(lc, "ldap-conffile", NULL, NULL);
        }

        ctx.user = user;

        if (!parse_conf(&ctx, cfile != NULL ? cfile : "/etc/login_ldap.conf"))
                return 0;


        if (!conn(&ctx)) {
                dlog(0, "ldap_open failed");
                return 0;
        }

        if (ctx.basedn == NULL) {
                if (!bind_password(&ctx, ctx.binddn, pass))
                        return 0;
                ctx.userdn = ctx.binddn;
        } else {
                if (!bind_password(&ctx, ctx.binddn, ctx.bindpw))
                        return 0;

                dlog(1, "bind success!");

                ctx.userdn = search(&ctx, ctx.basedn, ctx.filter, ctx.scope);
                if (ctx.userdn == NULL) {
                        dlog(1, "no user!");
                        return 0;
                }

        }
        dlog(1, "userdn %s", ctx.userdn);

        if (ctx.gbasedn != NULL && ctx.gfilter != NULL) {
                tmp = ctx.gfilter;
                if ((ctx.gfilter = parse_filter(&ctx, ctx.gfilter)) == NULL)
                        return 0;
                free(tmp);
                tmp = ctx.gbasedn;
                if ((ctx.gbasedn = parse_filter(&ctx, ctx.gbasedn)) == NULL)
                        return 0;
                free(tmp);

                if (search(&ctx, ctx.gbasedn, ctx.gfilter, ctx.gscope) == NULL) {
                        dlog(0, "user authenticated but failed group check: "
                            "%s", ctx.gfilter);
                        return 0;
                }
                dlog(1, "group filter matched!");
        }
        

        if (ctx.basedn != NULL) {
                if (!bind_password(&ctx, ctx.userdn, pass)) {
                        dlog(0, "user bind failed, dn: %s", ctx.userdn);
                        return 0;
                }
        }

        dlog(1, "user bind success!");

        return 1;
}

__dead void
usage(void)
{
        dlog(0, "usage: %s [-d] [-s service] [-v name=value] user [class]", getprogname());
        exit(1);
}