/*

 * Wyllys Ingersoll <[email protected]>

 *

 * Based on work by

 *   Daniel Kouril <[email protected]>

 *   James E. Robinson, III <[email protected]>

 *   Daniel Henninger <[email protected]>

 *   Ludek Sulak <[email protected]>

 */

/* ====================================================================

 * The Apache Software License, Version 1.1

 *

 * Copyright (c) 2000-2003 The Apache Software Foundation.  All rights

 * reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. The end-user documentation included with the redistribution,

 *    if any, must include the following acknowledgment:

 *       "This product includes software developed by the

 *        Apache Software Foundation (http://www.apache.org/)."

 *    Alternately, this acknowledgment may appear in the software itself,

 *    if and wherever such third-party acknowledgments normally appear.

 *

 * 4. The names "Apache" and "Apache Software Foundation" must

 *    not be used to endorse or promote products derived from this

 *    software without prior written permission. For written

 *    permission, please contact [email protected].

 *

 * 5. Products derived from this software may not be called "Apache",

 *    nor may "Apache" appear in their name, without prior written

 *    permission of the Apache Software Foundation.

 *

 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED

 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

 * DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT

 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

 * SUCH DAMAGE.

 * ====================================================================

 *

 * This software consists of voluntary contributions made by many

 * individuals on behalf of the Apache Software Foundation.  For more

 * information on the Apache Software Foundation, please see

 * <http://www.apache.org/>.

 *

 * Portions of this software are based upon public domain software

 * originally written at the National Center for Supercomputing Applications,

 * University of Illinois, Urbana-Champaign.

 */

/*

 * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.

 */

#include <sys/types.h>

#include <strings.h>

#include "httpd.h"

#include "http_config.h"

#include "http_core.h"

#include "http_log.h"

#include "http_protocol.h"

#include "http_request.h"

#include "ap_config.h"

#include "apr_base64.h"

#include "apr_lib.h"

#include "apr_time.h"

#include "apr_errno.h"

#include "apr_global_mutex.h"

#include "apr_strings.h"

#include "ap_compat.h"

#include <gssapi/gssapi.h>

#include <gssapi/gssapi_ext.h>

module auth_gss_module;

static void *gss_create_dir_config(apr_pool_t *, char *);

int gss_authenticate(request_rec *);

typedef struct {

	char *gss_service_name;

	char *keytab_file;

	int gss_debug;

} gss_auth_config;

static const char *set_service_name(cmd_parms *cmd, void *config,

	const char *name)

{

    ((gss_auth_config *) config)->gss_service_name = (char *)name;

    return NULL;

}

static const char *set_keytab_file(cmd_parms *cmd, void *config,

	const char *file)

{

	((gss_auth_config *) config)->keytab_file = (char *)file;

	return NULL;

}

static const char *set_gss_debug(cmd_parms *cmd, void *config,

	const char *debugflag)

{

	((gss_auth_config *) config)->gss_debug = atoi(debugflag);

	return NULL;

}

static const command_rec gss_auth_cmds[] = {

	AP_INIT_TAKE1("AuthGSSServiceName", set_service_name, NULL,

		OR_AUTHCFG, "Service name used for authentication."),

	AP_INIT_TAKE1("AuthGSSKeytabFile", set_keytab_file, NULL,

		OR_AUTHCFG,

		"Location of Kerberos V5 keytab file."),

	AP_INIT_TAKE1("AuthGssDebug", set_gss_debug, NULL,

		OR_AUTHCFG,

		"Enable debug logging in error_log"),

	{ NULL }

};

static void

gss_register_hooks(apr_pool_t *p)

{

	ap_hook_check_user_id(gss_authenticate,NULL,NULL,APR_HOOK_MIDDLE);

}

module AP_MODULE_DECLARE_DATA auth_gss_module = {

	STANDARD20_MODULE_STUFF,

	gss_create_dir_config,	/* dir config creater */

	NULL,			/* dir merger --- default is to override */

	NULL,			/* server config */

	NULL,			/* merge server config */

	gss_auth_cmds,		/* command apr_table_t */

	gss_register_hooks		/* register hooks */

};

typedef struct {

	gss_ctx_id_t context;

	gss_cred_id_t server_creds;

} gss_connection_t;

static gss_connection_t *gss_connection = NULL;

static void *

gss_create_dir_config(apr_pool_t *p, char *d)

{

	gss_auth_config *rec =

		(gss_auth_config *) apr_pcalloc(p, sizeof(gss_auth_config));

	((gss_auth_config *)rec)->gss_service_name = "HTTP";

	((gss_auth_config *)rec)->keytab_file = "/var/apache2/http.keytab";

	((gss_auth_config *)rec)->gss_debug = 0;

	return rec;

}

void log_rerror(const char *file, int line, int level, int status,

                const request_rec *r, const char *fmt, ...)

{

	char errstr[1024];

	va_list ap;

	va_start(ap, fmt);

	vsnprintf(errstr, sizeof(errstr), fmt, ap);

	va_end(ap);

	ap_log_rerror(file, line, level | APLOG_NOERRNO, NULL, r, "%s", errstr);

}

/*********************************************************************

 * GSSAPI Authentication

 ********************************************************************/

static const char *

gss_error_msg(apr_pool_t *p, OM_uint32 maj, OM_uint32 min, char *prefix)

{

	OM_uint32 maj_stat, min_stat; 

	OM_uint32 msg_ctx = 0;

	gss_buffer_desc msg;

	char *err_msg = (char *)apr_pstrdup(p, prefix);

	do {

		maj_stat = gss_display_status (&min_stat,

			maj, GSS_C_GSS_CODE,

			GSS_C_NO_OID, &msg_ctx,

			&msg);

		if (GSS_ERROR(maj_stat))

			break;

		err_msg = apr_pstrcat(p, err_msg, ": ", (char*) msg.value,

			NULL);

		(void) gss_release_buffer(&min_stat, &msg);

		maj_stat = gss_display_status (&min_stat,

			min, GSS_C_MECH_CODE,

			GSS_C_NULL_OID, &msg_ctx,

			&msg);

		if (!GSS_ERROR(maj_stat)) {

			err_msg = apr_pstrcat(p, err_msg,

				" (", (char*) msg.value, ")", NULL);

			(void) gss_release_buffer(&min_stat, &msg);

		}

	} while (!GSS_ERROR(maj_stat) && msg_ctx != 0);

	return (err_msg);

}

static int

cleanup_gss_connection(void *data)

{

	OM_uint32 ret;

	OM_uint32 minor_status;

	gss_connection_t *gss_conn = (gss_connection_t *)data;

	if (data == NULL)

		return 0; 

	if (gss_conn->context != GSS_C_NO_CONTEXT) {

		(void) gss_delete_sec_context(&minor_status,

			&gss_conn->context,

			GSS_C_NO_BUFFER);

	}

	if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL) {

		(void) gss_release_cred(&minor_status, &gss_conn->server_creds);

	}

	gss_connection = NULL;

	return 0; 

}

static int

acquire_server_creds(request_rec *r,

	gss_auth_config *conf,

	gss_OID_set mechset,

	gss_cred_id_t *server_creds)

{

	int ret = 0;

	gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;

	OM_uint32 major_status, minor_status, minor_status2;

	gss_name_t server_name = GSS_C_NO_NAME;

	char buf[1024];

	snprintf(buf, sizeof(buf), "%s@%s",

		conf->gss_service_name, r->hostname);

	if (conf->gss_debug)

   		log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

			"acquire_server_creds for %s", buf);

	input_token.value = buf;

	input_token.length = strlen(buf) + 1;

	major_status = gss_import_name(&minor_status, &input_token,

 			  GSS_C_NT_HOSTBASED_SERVICE,

			  &server_name);

	if (GSS_ERROR(major_status)) {

		log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

			"%s", gss_error_msg(r->pool, major_status, minor_status,

			"gss_import_name() failed"));

		return (HTTP_INTERNAL_SERVER_ERROR);

	}

	major_status = gss_acquire_cred(&minor_status, server_name,

		GSS_C_INDEFINITE,

		mechset, GSS_C_ACCEPT,

		server_creds, NULL, NULL);

	if (GSS_ERROR(major_status)) {

		log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

			"%s", gss_error_msg(r->pool, major_status, minor_status,

		      "gss_acquire_cred() failed"));

		ret = HTTP_INTERNAL_SERVER_ERROR;

	}

	(void) gss_release_name(&minor_status2, &server_name);

	return (ret);

}

static int

authenticate_user_gss(request_rec *r, gss_auth_config *conf,

	const char *auth_line, char **negotiate_ret_value)

{

	int ret = 0;

	OM_uint32 major_status, minor_status, minor_status2;

	gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;

	gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;

	const char *auth_param = NULL;

	gss_name_t client_name = GSS_C_NO_NAME;

	gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;

	if (conf->gss_debug)

		log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

		"authenticate_user_gss called");

	*negotiate_ret_value = (char *)"";

	if (gss_connection == NULL) {

		gss_connection = apr_pcalloc(r->connection->pool, sizeof(*gss_connection));

		if (gss_connection == NULL) {

			log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

		           "apr_pcalloc() failed (not enough memory)");

			ret = HTTP_INTERNAL_SERVER_ERROR;

			goto end;

		}

		(void) memset(gss_connection, 0, sizeof(*gss_connection));

		apr_pool_cleanup_register(r->connection->pool, gss_connection,

			cleanup_gss_connection, apr_pool_cleanup_null);

	}

	if (conf->keytab_file) {

		char *ktname;

		/*

		 * We don't use the ap_* calls here, since the string 

		 * passed to putenv() will become part of the enviroment 

		 * and shouldn't be free()ed by apache.

		 */

		ktname = malloc(strlen("KRB5_KTNAME=") + strlen(conf->keytab_file) + 1);

		if (ktname == NULL) {

			log_rerror(APLOG_MARK, APLOG_ERR, 0, r, 

				"malloc() failed: not enough memory");

			ret = HTTP_INTERNAL_SERVER_ERROR;

			goto end;

		}

		/*

		 * Put the keytab name in the environment so that Kerberos

		 * knows where to look later.

		 */

		sprintf(ktname, "KRB5_KTNAME=%s", conf->keytab_file);

		putenv(ktname);

		if (conf->gss_debug)

			log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Using keytab: %s", ktname);

	}

	/* ap_getword() shifts parameter */

	auth_param = ap_getword_white(r->pool, &auth_line);

	if (auth_param == NULL) {

		log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

			"No Authorization parameter in request from client");

		ret = HTTP_UNAUTHORIZED;

		goto end;

	}

	input_token.length = apr_base64_decode_len(auth_param) + 1;

	input_token.value = apr_pcalloc(r->connection->pool, input_token.length);

	if (input_token.value == NULL) {

		log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

	   	"apr_pcalloc() failed (not enough memory)");

		ret = HTTP_INTERNAL_SERVER_ERROR;

		goto end;

	}

	input_token.length = apr_base64_decode(input_token.value, auth_param);

	if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {

		gss_OID_set_desc desiredMechs;

		gss_OID_desc client_mech_desc;

		gss_OID client_mechoid = &client_mech_desc;

		char *mechstr = NULL;

		if (!__gss_get_mech_type(client_mechoid, &input_token)) {

			mechstr = (char *)__gss_oid_to_mech(client_mechoid);

		}

		if (mechstr == NULL) {

			client_mechoid = GSS_C_NULL_OID;

			mechstr = "<unknown>";

		}

		if (conf->gss_debug)   

			log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

				"Client wants GSS mech: %s", mechstr);

		desiredMechs.count = 1;

		desiredMechs.elements = client_mechoid;

		/* Get creds using the mechanism that the client requested */

		ret = acquire_server_creds(r, conf, &desiredMechs,

			&gss_connection->server_creds);

		if (ret)

			goto end;

	} 

	/*

	 * Try to display the server creds information.

	 */

	if (conf->gss_debug) {

		gss_name_t sname;

		gss_buffer_desc dname;

		major_status = gss_inquire_cred(&minor_status,

			gss_connection->server_creds,

			&sname, NULL, NULL, NULL);

		if (major_status == GSS_S_COMPLETE) {

			major_status = gss_display_name(&minor_status,

				sname, &dname, NULL);

		}

		if (major_status == GSS_S_COMPLETE) {

			log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

				"got server creds for: %.*s",

				(int)dname.length,

				(char *)dname.value);

			(void) gss_release_name(&minor_status, &sname);

			(void) gss_release_buffer(&minor_status, &dname);

		}

	}

	major_status = gss_accept_sec_context(&minor_status,

			  &gss_connection->context,

			  gss_connection->server_creds,

			  &input_token,

			  GSS_C_NO_CHANNEL_BINDINGS,

			  &client_name,

			  NULL,

			  &output_token,

			  NULL,

			  NULL,

			  &delegated_cred);

	if (output_token.length) {

		char *token = NULL;

		size_t len;

		len = apr_base64_encode_len(output_token.length) + 1;

		token = apr_pcalloc(r->connection->pool, len + 1);

		if (token == NULL) {

			log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

			"apr_pcalloc() failed (not enough memory)");

			ret = HTTP_INTERNAL_SERVER_ERROR;

			gss_release_buffer(&minor_status2, &output_token);

			goto end;

		}

		apr_base64_encode(token, output_token.value, output_token.length);

		token[len] = '\0';

		*negotiate_ret_value = token;

	}

	if (GSS_ERROR(major_status)) {

		log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

			"%s", gss_error_msg(r->pool, major_status, minor_status,

			"gss_accept_sec_context() failed"));

		/* Don't offer the Negotiate method again if call to GSS layer failed */

		*negotiate_ret_value = NULL;

		ret = HTTP_UNAUTHORIZED;

		goto end;

	}

	if (major_status == GSS_S_CONTINUE_NEEDED) {

		/*

		 * Some GSSAPI mechanisms may require multiple iterations to

		 * establish authentication.  Most notably, when MUTUAL_AUTHENTICATION

		 * flag is used, multiple round trips are needed.

		 */

		ret = HTTP_UNAUTHORIZED;

		goto end;

	}

	if (client_name != GSS_C_NO_NAME) {

		gss_buffer_desc name_token = GSS_C_EMPTY_BUFFER;

		major_status = gss_display_name(&minor_status, client_name,

			&name_token, NULL);

		if (GSS_ERROR(major_status)) {

			log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

				"%s", gss_error_msg(r->pool, major_status,

				minor_status,

				"gss_export_name() failed"));

			ret = HTTP_INTERNAL_SERVER_ERROR;

			goto end;

		}

		if (name_token.length)  {

			r->user = apr_pstrdup(r->pool, name_token.value);

			gss_release_buffer(&minor_status, &name_token);

		}

		if (conf->gss_debug)

			log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

				"Authenticated user: %s",

			r->user ?  r->user : "<unknown>");

	} 

	r->ap_auth_type = "Negotiate";

	ret = OK;

end:

	if (delegated_cred)

		gss_release_cred(&minor_status, &delegated_cred);

	if (output_token.length) 

		gss_release_buffer(&minor_status, &output_token);

	if (client_name != GSS_C_NO_NAME)

		gss_release_name(&minor_status, &client_name);

	cleanup_gss_connection(gss_connection);

	return ret;

}

static int

already_succeeded(request_rec *r)

{

	if (ap_is_initial_req(r) || r->ap_auth_type == NULL)

		return 0;

	return (strcmp(r->ap_auth_type, "Negotiate") ||

		(strcmp(r->ap_auth_type, "Basic") && strchr(r->user, '@')));

}

static void