/*

 * ProFTPD - FTP server daemon

 * Copyright (c) 2011, 2014, Oracle and/or its affiliates. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.

 *

 * As a special exemption, copyright holders give permission to link

 * this program with OpenSSL, and distribute the resulting executable,

 * without including the source code for OpenSSL in the source distribution.

 *

 */

#include "conf.h"

#include <bsm/adt.h>

#include <bsm/adt_event.h>

#include <security/pam_appl.h>

#include <sys/types.h>

#include <pwd.h>

#include <unistd.h>

#include <ucred.h>

#ifndef ADT_ftpd

#define ADT_ftpd	152

#endif

#ifndef ADT_ftpd_logout

#define ADT_ftpd_logout	153

#endif

module solaris_audit_module;

static adt_session_data_t *asession = NULL;

static int auth_retval = PAM_AUTH_ERR;

static void audit_autherr_ev(const void *event_data, void *user_data) {

  switch (*(int *)event_data) {

  case PR_AUTH_NOPWD:

    auth_retval = PAM_USER_UNKNOWN;

    break;

  case PR_AUTH_AGEPWD:

    auth_retval = PAM_CRED_EXPIRED;

    break;

  case PR_AUTH_DISABLEDPWD:

    auth_retval = PAM_ACCT_EXPIRED;

    break;

  case PR_AUTH_CRED_INSUFF:

    auth_retval = PAM_CRED_INSUFFICIENT;

    break;

  case PR_AUTH_CRED_UNAVAIL:

    auth_retval = PAM_CRED_UNAVAIL;

    break;

  case PR_AUTH_CRED_ERR:

    auth_retval = PAM_CRED_ERR;

    break;

  case PR_AUTH_UNAVAIL:

    auth_retval = PAM_AUTHINFO_UNAVAIL;

    break;

  case PR_AUTH_MAXTRIES:

    auth_retval = PAM_MAXTRIES;

    break;

  case PR_AUTH_INIT_FAIL:

    auth_retval = PAM_SESSION_ERR;

    break;

  case PR_AUTH_NEWTOK:

    auth_retval = PAM_NEW_AUTHTOK_REQD;

    break;

  case PR_AUTH_OPEN_ERR:

    auth_retval = PAM_OPEN_ERR;

    break;

  case PR_AUTH_SYMBOL_ERR:

    auth_retval = PAM_SYMBOL_ERR;

    break;

  case PR_AUTH_SERVICE_ERR:

    auth_retval = PAM_SERVICE_ERR;

    break;

  case PR_AUTH_SYSTEM_ERR:

    auth_retval = PAM_SYSTEM_ERR;

    break;

  case PR_AUTH_BUF_ERR:

    auth_retval = PAM_BUF_ERR;

    break;

  case PR_AUTH_CONV_ERR:

    auth_retval = PAM_CONV_ERR;

    break;

  case PR_AUTH_PERM_DENIED:

    auth_retval = PAM_PERM_DENIED;

    break;

  default: /* PR_AUTH_BADPWD */

    auth_retval = PAM_AUTH_ERR;

    break;

  }

}

static void audit_failure(pool *p, char *authuser) {

  adt_event_data_t *event = NULL;

  const char *how;

  int saved_errno = 0;

  struct passwd pwd;

  struct passwd *result = NULL;

  char *pwdbuf = NULL;

  size_t pwdbuf_len;

  long pwdbuf_len_max;

  uid_t uid = ADT_NO_ATTRIB;

  gid_t gid = ADT_NO_ATTRIB;

  if ((pwdbuf_len_max = sysconf(_SC_GETPW_R_SIZE_MAX)) == -1) {

    saved_errno = errno;

    how = "couldn't determine maximum size of password buffer";

    goto fail;

  }

  pwdbuf_len = (size_t)pwdbuf_len_max;

  pwdbuf = pcalloc(p, pwdbuf_len);

  if (adt_start_session(&asession, NULL, ADT_USE_PROC_DATA) != 0) {

    saved_errno = errno;

    how = "couldn't start adt session";

    goto fail;

  }

  if ((authuser != NULL) && (authuser[0] != NULL) &&

    (getpwnam_r(authuser, &pwd, pwdbuf, pwdbuf_len, &result) == 0) &&

    (result != NULL)) {

    uid = pwd.pw_uid;

    gid = pwd.pw_gid;

  } 

  if (adt_set_user(asession, uid, gid, uid, gid, NULL, ADT_NEW) != 0) {

    saved_errno = errno;

    how = "couldn't set adt user";

    goto fail;

  }

  if ((event = adt_alloc_event(asession, ADT_ftpd)) == NULL) {

    saved_errno = errno;

    how = "couldn't allocate adt event";

    goto fail;

  }

  if (adt_put_event(event, ADT_FAILURE, ADT_FAIL_PAM + auth_retval) != 0) {

    saved_errno = errno;

    how = "couldn't put adt event";

    goto fail;

  }

  adt_free_event(event);

  (void) adt_end_session(asession);

  asession = NULL;

  return;

fail:

  pr_log_pri(PR_LOG_ERR, "Auditing of login failed: %s (%s)", how,

    strerror(saved_errno));

  adt_free_event(event);

  (void) adt_end_session(asession);

  asession = NULL;

}

static void audit_success(void) {

  adt_event_data_t *event = NULL;

  const char *how;

  int saved_errno = 0;

  if (adt_start_session(&asession, NULL, ADT_USE_PROC_DATA) != 0) {

    saved_errno = errno;

    how = "couldn't start adt session";

    goto fail;

  }

  if ((event = adt_alloc_event(asession, ADT_ftpd)) == NULL) {

    saved_errno = errno;

    how = "couldn't allocate adt event";

    goto fail;

  }

  if (adt_put_event(event, ADT_SUCCESS, ADT_SUCCESS) != 0) {

    saved_errno = errno;

    how = "couldn't put adt event";

    goto fail;

  }

  adt_free_event(event);

  /* Don't end adt session - leave for when logging out. */

  return;

fail:

  pr_log_pri(PR_LOG_ERR, "Auditing of login failed: %s (%s)", how,

    strerror(saved_errno));

  adt_free_event(event);

  /* Don't end adt session - leave for when logging out. */

}

static void audit_logout(void) {

  adt_event_data_t *event = NULL;

  const char *how;

  int saved_errno = 0;

  /* If audit session was not created during login then leave */

  if (asession == NULL)

    return;

  if ((event = adt_alloc_event(asession, ADT_ftpd_logout)) == NULL) {

    saved_errno = errno;

    how = "couldn't allocate adt event";

    goto fail;

  }

  if (adt_put_event(event, ADT_SUCCESS, ADT_SUCCESS) != 0) {

    saved_errno = errno;

    how = "couldn't put adt event";

    goto fail;

  }

  adt_free_event(event);

  (void) adt_end_session(asession);

  asession = NULL;

  return;

fail:

  pr_log_pri(PR_LOG_ERR, "Auditing of logout failed: %s (%s)", how,

    strerror(saved_errno));

  adt_free_event(event);

  (void) adt_end_session(asession);

  asession = NULL;

}

/* Logout */

static void audit_exit_ev(const void *event_data, void *user_data) {

  audit_logout();

}

/* Login passed */

MODRET solaris_audit_post_pass(cmd_rec *cmd) {

  audit_success();

  /* Set handler for logout/timeout */

  pr_event_register(&solaris_audit_module, "core.exit", audit_exit_ev, NULL);

  return PR_DECLINED(cmd);

}

/* Login failed */

MODRET solaris_audit_post_fail(cmd_rec *cmd) {

  char *login_user;

  login_user = pr_table_get(session.notes, "mod_auth.orig-user", NULL);

  audit_failure(cmd->tmp_pool, login_user);

  return PR_DECLINED(cmd);

}

static int audit_sess_init(void) {

  adt_session_data_t *aht;

  adt_termid_t *termid;

  priv_set_t *privset;

  int rval = -1;					

  /* add privs for audit init */

  if ((privset = priv_allocset()) == NULL) {

    pr_log_pri(PR_LOG_ERR, "Auditing privilege initialization failed");

    return rval;

  }

  (void) getppriv(PRIV_EFFECTIVE, privset);

  priv_addset(privset, PRIV_SYS_AUDIT);

  (void) setppriv(PRIV_SET, PRIV_EFFECTIVE, privset);

  /* basic terminal id setup */

  if (adt_start_session(&aht, NULL, 0) != 0) {

    pr_log_pri(PR_LOG_ERR, "pam adt_start_session: %s", strerror(errno));

    goto out;

  }

  if (adt_load_termid(session.c->rfd, &termid) != 0) {

    pr_log_pri(PR_LOG_ERR, "adt_load_termid: %s", strerror(errno));

    (void) adt_end_session(aht);

    goto out;

  }

  if (adt_set_user(aht, ADT_NO_AUDIT, ADT_NO_AUDIT, 0, ADT_NO_AUDIT, termid,

    ADT_SETTID) != 0) {

    pr_log_pri(PR_LOG_ERR, "adt_set_user: %", strerror(errno));

    free(termid);

    (void) adt_end_session(aht);

    goto out;

  }

  free(termid);

  if (adt_set_proc(aht) != 0) {

    pr_log_pri(PR_LOG_ERR, "adt_set_proc: %", strerror(errno));

    (void) adt_end_session(aht);

    goto out;

  }

  (void) adt_end_session(aht);

  /* Set handler for authentication error */

  pr_event_register(&solaris_audit_module, "mod_auth.authentication-code",

    audit_autherr_ev, NULL);

  rval = 0;

out:

  /* remove unneeded privileges */

  priv_delset(privset, PRIV_SYS_AUDIT);

  (void) setppriv(PRIV_SET, PRIV_EFFECTIVE, privset);

  (void) setpflags(PRIV_AWARE_RESET, 1);

  priv_freeset(privset);

  return rval;

}

#define EVENT_KEY       "event"

/* Helper functions and global variables

 * for the file transfer command handlers.

 * {

 */

static char src_realpath[PATH_MAX];

static char dst_realpath[PATH_MAX];

/*

 * If an error occurs in any of the file transfer handlers,

 * and the handler wants to return PR_ERROR(cmd), then it is necessary

 * to send some FTP error message to user. This is in order to prevent

 * a hang-up of the user's ftp client.

 *

 * This function sends the 451 error message to the user.

 * It is only called in the "pre-" handlers. When a "pre-" handler

 * returns PR_ERROR(cmd), then the corresponding "post_err-"

 * handler is also called. Therefore it can happen that an error condition

 * (such as no memory) can be logged (with the pr_log_pri() routine) twice.

 * Once in the "pre-" handler, and once in the "post_err-" handler.

 */

static void error_451(void)

{

  pr_response_add_err(R_451,

    "Requested action aborted: local error in processing.\n");

}

/*

 * Allocate resources to process a command outcome.

 *

 * All file transfer command handlers need to allocate adt_event_data_t

 * structure and also make a copy of the command argument.

 * This function does both. If it can't, it logs an error and returns NULL.

 * On success, it returns the pointer (event) to the allocated adt_event_data_t

 * structure.

 *

 * If arg2 is not NULL, it makes a copy of the first (and only) command

 * argument (using the memory pool "pool" from "cmd") and stores it to *arg2.

 * There must be always exactly one command argument, otherwise it is an error.

 *

 * On success, the pointer to the created event structure is stored

 * into cmd under "notes" variable, so that it is accessible

 * by the subsequent corresponding "post-" or "post_err-" command handler.

 */

adt_event_data_t* __solaris_audit_pre_arg2(

    cmd_rec *cmd, const char* description, int event_type, char **arg2) {

  adt_event_data_t *event = NULL;

  const char *how = "";

  char *tmp = NULL;

  /* The ftp server code will save errno into this variable

   * in case an error happens, and there is a valid errno for it.

   */

  cmd->error_code = ADT_FAILURE;

  if (cmd->arg == NULL) {

    pr_log_pri(PR_LOG_ERR, "Auditing of %s failed: %s",

      description, "bad argument");

    goto err;

  }

  if (arg2 != NULL) {

    *arg2 = NULL;

    if ((tmp = pstrdup(cmd->pool, cmd->arg)) == NULL) {

      how = "no memory";

      pr_log_pri(PR_LOG_ERR, "Auditing of %s(%s) failed: %s",

        description, cmd->arg, how);

      goto err;

    }

    *arg2 = tmp;

  }

  if (cmd->notes == NULL) {

    pr_log_pri(PR_LOG_ERR, "Auditing of %s(%s) failed: %s",

      description, cmd->arg, "API error, notes is NULL");

    goto err;

  }

  if ((event = adt_alloc_event(asession, event_type)) == NULL) {

    how = "couldn't allocate adt event";

    pr_log_pri(PR_LOG_ERR, "Auditing of %s(%s) failed: %s(%s)",

      description, cmd->arg, how, strerror(errno));

    goto err;

  }

  if (pr_table_add(cmd->notes, EVENT_KEY, event, sizeof(*event)) == -1) {

    how = "pr_table_add() failed";

    pr_log_pri(PR_LOG_ERR, "Auditing of %s(%s) failed: %s",

      description, cmd->arg, how);

    adt_free_event(event);

    goto err;

  }

  return event;

err:

  return NULL;

}

/*

 * This function implements logic that is common to most "post-"

 * and "post_err-" file transfer command handlers.

 *

 * It retrieves the pointer (event) to the adt_event_data_t structure

 * from "cmd->notes" and logs it. This structure has been created by the

 * __solaris_audit_pre_arg2() function.

 * 

 * Some audit event structures contain an optional *_stat member.

 * If "fill_attr" is not NULL, it is called to fill in this member,

 * before the audit event is logged.

 *

 * This function always returns PR_DECLINED, even if it failed

 * to log the audit event. The reason is that it is called in the

 * "post-" file transfer command handlers, which means that the command

 * has been already successfully executed by the ftp server.

 */

MODRET __solaris_audit_post(cmd_rec *cmd,

  const char* description, int exit_status, int __unused,

  const char* (*fill_event)(cmd_rec *cmd, adt_event_data_t *event))

{

  adt_event_data_t *event = NULL;

  const char* how = "";

  const char* msg = NULL;

  size_t size = 0;

  int exit_error = cmd->error_code;

  event = (adt_event_data_t*)pr_table_remove(cmd->notes, EVENT_KEY, &size);

  if (event == NULL) {

    how = "event is NULL";

    pr_log_pri(PR_LOG_ERR, "Auditing of %s failed: %s", description, how);

    goto out;

  }

  if (size != sizeof(*event)) {

    how = "bad event size";

    pr_log_pri(PR_LOG_ERR, "Auditing of %s failed: %s", description, how);

    goto out;

  }

  if (fill_event != NULL) {

    msg = fill_event(cmd, event);

    if (msg != NULL) {

      pr_log_pri(PR_LOG_ERR, "Auditing of %s failed: %s", description, msg);

      goto out;

    }

  }

  /* It can happen, that the ftp command succeeds but only to some degree.

   * In such case, the exit_error might contain the errno number

   * of the failure.

   */

  if (exit_status == ADT_SUCCESS) {

    if (exit_error == ADT_FAILURE)

      exit_error = ADT_SUCCESS;

  }

  if (adt_put_event(event, exit_status, exit_error) != 0) {

    how = "couldn't put adt event";

    pr_log_pri(PR_LOG_ERR, "Auditing of %s failed: %s (%s)",

      description, how, strerror(errno));

  }

  adt_free_event(event);

out:

  return PR_DECLINED(cmd);

}

/*

 * This is a generic function to fill in the given "stat" member

 * of some audit event structure. The path and the member are specified

 * by the caller. The pointer to cmd is supplied, because the stat64

 * structure has to be allocated (the "stat" member is a pointer).

 *

 * The function returns NULL on success.

 * In case of an error, it returns a descriptive message.

 * This message is used by the caller to log an error.

 *

 * For some file transfer commands, the "stat" member is filled in

 * the "pre-" handler (because the file is expected to exist prior

 * to the execution of the command). For other file transfer commands,

 * the "stat" member is filled in the "post-" handler (because

 * the file is expected _not_ to exist prior to the execution of the command,

 * but to exist after the command execution).

 */

static const char* __fill_attr

(

  cmd_rec *cmd, const char* path, adt_stat_t **ret)

{

  struct stat64 *ptr;