/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#include <openssl/ssl.h>

#include <openssl/err.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <sys/utsname.h>

#include <sys/stat.h>

#include <sys/wait.h>

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <errno.h>

#include <unistd.h>

#include <spawn.h>

#include "rad_object.h"

#include "rad_modapi.h"

#include "rad_modapi_xport.h"

#include "rad_connection.h"

#include "rad_util.h"

#include "rad_xport.h"

#include "rad_log.h"

#include "../rad_listen.h"

#include "api_tls.h"

typedef struct ssldata {

	SSL *ssl;

	int fd;

} ssldata_t;

static int

rad_tls_read(radmod_connection_t *conn, char *buf, int len)

{

	ssldata_t *sdata = conn->rm_conn_xport_data;

	int res = SSL_read(sdata->ssl, buf, len);

	if (res == 0)

		conn->rm_conn_state = RCS_EOF; /* XXX: Not necessarily true? */

	return (res > 0 ? res : -1);

}

static int

rad_tls_write(radmod_connection_t *conn, char *buf, int len)

{

	ssldata_t *sdata = conn->rm_conn_xport_data;

	return (SSL_write(sdata->ssl, buf, len));

}

static void

rad_tls_close(radmod_connection_t *conn)

{

	ssldata_t *sdata = conn->rm_conn_xport_data;

	SSL_shutdown(sdata->ssl);

}

static void

rad_tls_free(radmod_connection_t *conn)

{

	ssldata_t *sdata = conn->rm_conn_xport_data;

	SSL_free(sdata->ssl);

	(void) close(sdata->fd);

	free(sdata);

}

static boolean_t

generate_cert(const char *cert, const char *key)

{

	struct utsname name;

	struct stat st;

	pid_t pid;

	char buffer[1024];

	const char *args[] = {

	    "/usr/bin/openssl", "req", "-x509", "-newkey", "rsa:1024",

	    "-days", "3650", "-sha1", "-nodes", "-keyout", key,

	    "-out", cert, "-subj", buffer, NULL };

	if (stat(cert, &st) != -1 && stat(key, &st) != -1)

		return (B_TRUE);

	(void) uname(&name);

	(void) snprintf(buffer, 1024, "/CN=Remote Administration Daemon @ %s",

	    name.nodename);

	rad_log(RL_WARN, "generating key/certificate pair\n");

	if (posix_spawn(&pid, args[0], NULL, NULL, (char **)args, NULL) != 0) {

		return (B_FALSE);

	}

	while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)

		;

	return (B_TRUE);

}

static radmod_transport_t transport = {

	rad_tls_read,

	rad_tls_write,

	rad_tls_close,

	rad_tls_free

};

static void

tls_run(void *arg)

{

	radmod_connection_t *conn = arg;

	rad_proto_handle(conn);

	free(conn);

}

static rad_moderr_t

tls_listen(rad_thread_t *arg)

{

	SSL_CTX *context;

	SSL *ssl;

	int fd;

	data_t *d, *data = rad_thread_arg(arg);

	int port = struct_get(data, "port")->d_data.integer;

	d = struct_get(data, "proto");

	const char *protostr = d != NULL ? d->d_data.string : "rad";

	d = struct_get(data, "localonly");

	boolean_t local = d != NULL ? d->d_data.boolean : B_FALSE;

	d = struct_get(data, "certificate");

	const char *cert = d->d_data.string;

	d = struct_get(data, "privatekey");

	const char *key = d->d_data.string;

	d = struct_get(data, "generate");

	boolean_t generate = d != NULL ? d->d_data.boolean : B_FALSE;

	if (generate && !generate_cert(cert, key)) {

		rad_log(RL_ERROR, "Failed to generate certificate.\n");

		return (rm_system);

	}

	rad_protocol_t *proto = rad_proto_find(protostr);

	if (proto == NULL) {

		rad_log(RL_ERROR, "Unable to find protocol \"%s\".\n",

		    protostr);

		return (rm_config);

	}

	if ((fd = listen_on_port(port, local)) < 0) {

		rad_log(RL_ERROR, "Error starting server on port %d\n",

		    port);

		return (rm_system);

	}

	rad_log(RL_DEBUG, "Initializing SSL library.\n");

	(void) SSL_library_init();

	(void) SSL_load_error_strings();

	rad_log(RL_DEBUG, "Creating SSL context.\n");

	context = SSL_CTX_new(SSLv23_method());

	if (context == NULL) {

		rad_log(RL_ERROR, "Unable to create SSL context.\n");

		return (rm_system);

	}

	SSL_CTX_set_options(context, SSL_OP_NO_SSLv2);

	if (SSL_CTX_use_certificate_chain_file(context, cert) == 0) {

		rad_log(RL_ERROR, "Unable to use cert file: %s\n", cert);

		ERR_print_errors_fp(stderr);

		return (rm_system);

	}

	if (SSL_CTX_use_PrivateKey_file(context, key, SSL_FILETYPE_PEM) == 0) {

		rad_log(RL_ERROR, "Unable to use privatekey file: %s\n", key);

		ERR_print_errors_fp(stderr);

		return (rm_system);

	}

	rad_thread_ack(arg, rm_ok);

	for (;;) {

		int afd, result;

		rad_log(RL_DEBUG, "Waiting for connection.\n");

		if ((afd = accept(fd, 0, 0)) == -1) {

			rad_log(RL_WARN, "Error in accept(): %s\n",

			    strerror(errno));

			continue;

		}

		rad_log(RL_DEBUG, "Connection accepted.\n");

		rad_log(RL_DEBUG, "Creating SSL.\n");

		ssl = SSL_new(context);

		if (ssl == NULL) {

			rad_log(RL_WARN, "Unable to create SSL.\n");

			(void) close(afd);

			continue;

		}

		rad_log(RL_DEBUG, "Initiating SSL connection.\n");

		if (!SSL_set_fd(ssl, afd)) {

			rad_log(RL_WARN, "Unable to set SSL fd.\n");

			goto close;

		}

		rad_subject_t *subject = rad_subject_create_fd(afd, B_FALSE);

		if (subject == NULL) {

			rad_log(RL_WARN, "Unable to allocate subject.\n");

			goto close;

		}

		while ((result = SSL_accept(ssl)) != 1) {

			result = SSL_get_error(ssl, result);

			/* Shouldn't happen, but just in case: */

			if (result == SSL_ERROR_WANT_READ ||

			    result == SSL_ERROR_WANT_WRITE)

				continue;

			ERR_print_errors_fp(stderr);

			rad_log(RL_WARN,

			    "Unable to establish connection: %d\n", result);

			goto close;

		}

		rad_log(RL_DEBUG, "Connection accepted.\n");

		ssldata_t *sdata = zalloc(sizeof (ssldata_t));

		sdata->ssl = ssl;

		sdata->fd = afd;

		radmod_connection_t *conn = rad_conn_create();

		conn->rm_conn_xport_ops = &transport;

		conn->rm_conn_xport_data = sdata;

		conn->rm_conn_proto_ops = proto;

		conn->rm_conn_subject = subject;

		if (rad_thread_create_async(tls_run, conn) != rm_ok) {

			rad_conn_close(conn);

			free(conn);

		}

		continue;

close:

		SSL_free(ssl);

		(void) close(afd);

	}

}

static rad_moderr_t

starter(data_t *data)

{

	/*

	 * Verify parameters.

	 */

	data_t *d;

	if ((d = struct_get(data, "port")) == NULL) {

		rad_log(RL_ERROR, "Port required\n");

		return (rm_config);

	}

	if ((d = struct_get(data, "certificate")) == NULL) {

		rad_log(RL_ERROR, "Cert required\n");

		return (rm_config);

	}

	if ((d = struct_get(data, "privatekey")) == NULL) {

		rad_log(RL_ERROR, "Private key required\n");

		return (rm_config);

	}

	return (rad_thread_create(tls_listen, data));

}

static rad_modinfo_t modinfo = { "xport_tls", "TLS socket transport module" };

int

_rad_init(void *handle)

{

	if (rad_module_register(handle, RAD_MODVERSION, &modinfo) == -1)

		return (-1);

	rad_xport_register("tls", &t__tls, starter);

	return (0);

}