#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# Copyright (c) 2018, Joyent, Inc.

SBINPROG = gsscred

INCDIRS = -I. -I$(ROOT)/usr/include

LIBPATH = -L$(ROOT)/usr/lib

PROG= $(SBINPROG)

GSSCREDOBJS = gsscred.o gsscred_utils.o gsscred_file.o

OBJS	= $(GSSCREDOBJS)
SRCS	= $(OBJS:.o=.c)

include ../../Makefile.cmd

TEXT_DOMAIN = SUNW_OST_NETRPC
POFILE = $(PROG).po
POFILES = generic.po

ROOTBINPROG=		$(BINPROG:%=$(ROOTBIN)/%)

COPTFLAG += $(INCDIRS) $(LIBPATH)

# not linted
SMATCH=off

LDLIBS += -lgss

$(GPROGS) : CPPFLAGS += -DSYSV -DSunOS=50

.KEEP_STATE:

all: $(PROG)

gsscred:	$(OBJS)
	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
	$(POST_PROCESS)

$(ROOTBINPROG):
	$(INS.dir)

$(ROOTUSRSBIN)/%:	%
	$(INS.file)

install: all $(DIRS) $(ROOTBINPROG) $(ROOTUSRSBIN)/gsscred

install_h:

clean:
	$(RM) $(OBJS)
	$(RM) $(PROG)

lint: lint_SRCS

include ../../Makefile.targ

$(POFILE): $(DERIVED_FILES) .WAIT $(POFILES)
	$(RM) $@
	$(CAT) $(POFILES) > $@

generic.po: FRC
	$(RM) messages.po
	$(XGETTEXT) $(XGETFLAGS) `$(GREP) -l gettext *.[ch]`
	$(SED) "/^domain/d" messages.po > $@
	$(RM) messages.po

FRC:
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1997-2002 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  gsscred utility
 *  Manages mapping between a security principal name and unix uid
 */

#include <stdio.h>
#include <stdlib.h>
#include <pwd.h>
#include <unistd.h>
#include <string.h>
#include <gssapi/gssapi_ext.h>
#include "gsscred.h"

#define	MAX_STR_LEN	1024


/*
 * Internal Functions
 */
static void usage(void);
static void addUser(const char *name, const char *oid, const char *userUid,
		const char *userComment, const char *userMech);
static int file_listUsers(const gss_OID mechOid, const char *userUid,
		char **errDetails);
static int listUsers(const char *name, const char *nameTypeOid,
		const char *uid, const char *mechOid);
static int file_removeUsers(const gss_OID mechOid, const char *userUid,
		char **errDetails);
static int removeUsers(const char *name, const char *nameTypeOid,
		const char *uid, const char *mechOid);

/*
 * Global variables
 */
static int tableSource;
static char *PROG_NAME = NULL;

int
main(int argc, char *args[])
{
	char *userName = NULL, *nameTypeOID = NULL,
		*uid = NULL, *comment = NULL, *mech = NULL,
		operation = '0';
	int c, errflag = 0;
	extern char *optarg;

	PROG_NAME = *args;

	/* set locale and domain for internationalization */
	setlocale(LC_ALL, "");
	textdomain(TEXT_DOMAIN);

	if (argc < 2)
		usage();

	/* Process the input arguments */
	while ((c = getopt(argc, args, "arln:o:u:m:c:")) != EOF) {

		switch (c) {
		case 'n':
			userName = optarg;
			break;

		case 'o':
			nameTypeOID = optarg;
			break;

		case 'u':
			uid = optarg;
			break;

		case 'm':
			mech = optarg;
			break;

		case 'c':
			comment = optarg;
			break;

		case 'a':
		case 'r':
		case 'l':
			operation = c;
			errflag++;
			if (errflag > 1)
				usage();
			break;

		default:
			usage();
		}
	}

	/* determine which back-end to use as the gsscred store */
	tableSource = gsscred_read_config_file();

	/* perform the requested operation */
	switch (operation) {
		case 'a':
			addUser(userName, nameTypeOID, uid, comment, mech);
			break;

		case 'r':
			removeUsers(userName, nameTypeOID, uid, mech);
			break;

		case 'l':
			listUsers(userName, nameTypeOID, uid, mech);
			break;

		default:
			usage();
	}
	fprintf(stdout, "\n");
	return (0);
}  /* main */

/*
 * Handles the addition of users to the gsscred table.
 */
static void
addUser(const char *name, const char *nameOidStr,
	    const char *userUid, const char *userComment,
	    const char *mechOidStr)
{
	gss_OID mechOid;
	gss_buffer_desc fullName = GSS_C_EMPTY_BUFFER,
		hexBufDesc = GSS_C_EMPTY_BUFFER,
		hexMechOid = GSS_C_EMPTY_BUFFER;
	char comment[MAX_STR_LEN+1], hexBuf[MAX_STR_LEN+MAX_STR_LEN+1],
		hexMechOidBuf[MAX_STR_LEN+1], *commentPtr = NULL,
		*errDetail = NULL, uidStr[256], *uidPtr;
	struct passwd *aUser;
	OM_uint32 minor;
	int count = 0, retCode;

	hexMechOid.length = MAX_STR_LEN;
	hexMechOid.value = (void*)hexMechOidBuf;

	/* addition of users can only be performed by super users */
	if (getuid()) {
		fprintf(stderr,
			gettext("\nUser addition requires"
				" root privileges."));
		return;
	}

	/* the mechanism OID is required */
	if (mechOidStr == NULL) {
		fprintf(stderr, gettext("\nUnspecified mechanism."));
		usage();
	}

	/* Convert from string mechanism Oid to ASN.1 oid and then hex */
	if (__gss_mech_to_oid(mechOidStr, &mechOid) != GSS_S_COMPLETE) {
		fprintf(stderr,
			gettext("\nInvalid mechanism specified [%s]."),
			mechOidStr);
		return;
	}

	hexBufDesc.length = mechOid->length;
	hexBufDesc.value = mechOid->elements;

	if (!gsscred_AsHex(&hexBufDesc, &hexMechOid)) {
		fprintf(stderr,
			gettext("\nInternal error.  "
				"Conversion to hex failed."));
		return;
	}

	/*
	 * if the name is specified, then do single addition.
	 * Might have to look up the uid.
	 */
	if (name != NULL) {
		hexBufDesc.length = sizeof (hexBuf);
		hexBufDesc.value = hexBuf;

		/* build the name as needed */
		if (!gsscred_MakeName(mechOid, name, nameOidStr, &fullName)) {
			fprintf(stderr,
				gettext("\nError adding user [%s]."), name);
			return;
		}

		/* convert it to hex */
		if (!gsscred_AsHex(&fullName, &hexBufDesc)) {
			gss_release_buffer(&minor, &fullName);
			fprintf(stderr,
				gettext("\nInternal error.  "
					"Conversion to hex failed."));
			return;
		}

		/* might require the lookup of the uid if one not specified */
		if (userUid == NULL) {

			if ((aUser = getpwnam(name)) == NULL) {
				fprintf(stderr,
					gettext("\nUnable to obtain password"
						" information for [%s]."),
					name);
				gss_release_buffer(&minor, &fullName);
				return;
			}
			sprintf(uidStr, "%ld", aUser->pw_uid);
			uidPtr = uidStr;
		}
		else
			uidPtr = (char *)userUid;

		if (userComment == NULL) {
			sprintf(comment, "%s, %s", name, mechOidStr);
			commentPtr = comment;
		} else
			commentPtr = (char *)userComment;

		if (tableSource == GSSCRED_FLAT_FILE)
			retCode = file_addGssCredEntry(&hexBufDesc,
					uidPtr, commentPtr, &errDetail);
		else
			/* other backends (ldap, dss) coming soon */
			retCode	= 0;

		if (!retCode) {
			fprintf(stderr, gettext("\nError adding user [%s]."),
				commentPtr);

			if (errDetail) {
				fprintf(stderr, "\n%s\n", errDetail);
				free(errDetail);
				errDetail = NULL;
			}
		}

		gss_release_buffer(&minor, &fullName);
		return;
	}

	/*
	 * since no name specified, then we will load everyone from
	 * password table.  This means that -u and -o options are invalid.
	 * We just ignore it, but we could flag it as error.
	 */
	setpwent();

	while ((aUser = getpwent()) != NULL) {
		hexBufDesc.length = sizeof (hexBuf);
		hexBufDesc.value = hexBuf;

		if (!gsscred_MakeName(mechOid, aUser->pw_name,
			nameOidStr, &fullName)) {
			fprintf(stderr,
				gettext("\nError adding user [%s]."),
				aUser->pw_name);
			continue;
		}

		if (!gsscred_AsHex(&fullName, &hexBufDesc)) {
			gss_release_buffer(&minor, &fullName);
			fprintf(stderr,
				gettext("\nInternal error.  "
					"Conversion to hex failed."));
			continue;
		}

		sprintf(uidStr, "%ld", aUser->pw_uid);
		sprintf(comment, "%s, %s", aUser->pw_name, mechOidStr);
		if (tableSource == GSSCRED_FLAT_FILE)
			retCode = file_addGssCredEntry(&hexBufDesc,
					uidStr, comment, &errDetail);
		else
			retCode	= 0;

		if (!retCode) {
			fprintf(stderr,
				gettext("\nError adding user [%s]."),
				comment);

			if (errDetail) {
				fprintf(stderr, "\n%s\n", errDetail);
				free(errDetail);
				errDetail = NULL;
			}
		} else {
			count++;
			if ((count % 50) == 0)
				fprintf(stdout,
					gettext("\n[%d] users added..."),
					count);
		}
		gss_release_buffer(&minor, &fullName);
	}
	endpwent();
}  /* addUser */


/*
 *  Handles the searching of the gsscred table.
 */
static int listUsers(const char *name, const char *nameOidStr,
		const char *uidStr, const char *mechOidStr)
{
	GssCredEntry *entryPtr, *entryTmpPtr;
	char hexMech[256],
		hexName[(MAX_STR_LEN *2) + 1];
	gss_OID anOid = NULL, userMechOid = NULL;
	gss_OID_set mechSet = NULL;
	gss_buffer_desc inBufDesc = GSS_C_EMPTY_BUFFER,
		outBufDesc = GSS_C_EMPTY_BUFFER,
		searchName = GSS_C_EMPTY_BUFFER;
	int status = 1, numOfMechs, i;
	OM_uint32 minor;
	char *errDetails = NULL;

	/* Do we need to convert the mechanism oid? */
	if (mechOidStr != NULL) {

		if (__gss_mech_to_oid(mechOidStr, &userMechOid) !=
			GSS_S_COMPLETE) {
			fprintf(stderr,
				gettext("\nInvalid mechanism specified [%s]."),
				mechOidStr);
			return (0);
		}
		inBufDesc.length = userMechOid->length;
		inBufDesc.value = userMechOid->elements;
		outBufDesc.length = sizeof (hexMech);
		outBufDesc.value = hexMech;

		if (!gsscred_AsHex(&inBufDesc, &outBufDesc)) {
			fprintf(stderr,
				gettext("\nInternal error.  "
					"Conversion to hex failed."));
			status = 0;
			goto cleanup;
		}

	}	/* mechOidStr != NULL */

	/* are we retrieving everyone ? or searching by mech ? */
	if ((name == NULL && uidStr == NULL && mechOidStr == NULL) ||
	    (name == NULL && uidStr == NULL)) {

		if (tableSource == GSSCRED_FLAT_FILE) {
			file_listUsers(userMechOid, NULL, &errDetails);

			if (errDetails) {
				fprintf(stderr,
					gettext("\nError searching gsscred"
						" table [%s]."),
					errDetails);
				free(errDetails);
				errDetails = NULL;
				return (0);
			}
			return (1);
		}

	}

	/* Are we searching by uid or uid and mech? */
	if (name == NULL && uidStr != NULL) {

		if (tableSource == GSSCRED_FLAT_FILE)
			file_listUsers(userMechOid, uidStr, &errDetails);
		else {
			entryPtr = NULL;
			while (entryPtr != NULL) {
				fprintf(stdout, "\n%s\t%d\t%s",
					entryPtr->principal_name,
					entryPtr->unix_uid, entryPtr->comment);
				free(entryPtr->principal_name);
				free(entryPtr->comment);
				entryTmpPtr = entryPtr->next;
				free(entryPtr);
				entryPtr = entryTmpPtr;
			}
		}

		/* check for any errors */
		if (errDetails) {
			fprintf(stderr,
				gettext("\nError searching gsscred table "
					"[%s]."),
				errDetails);
			free(errDetails);
			errDetails = NULL;
			status = 0;
		}

		goto cleanup;
	}

	/*
	 * We are searching by name;
	 * how many mechs must we check?
	 */
	if (mechOidStr == NULL) {

		if (gss_indicate_mechs(&minor, &mechSet) != GSS_S_COMPLETE) {
			fprintf(stderr,
				gettext("\nInternal error.  "
					"GSS-API call failed."));
			return (0);
		}
		numOfMechs = mechSet->count;
	}
	else
		numOfMechs = 1;

	/* now look through all the mechs searching */
	for (i = 0; i < numOfMechs; i++) {

		if (mechOidStr == NULL) {
			anOid = &mechSet->elements[i];
			inBufDesc.length = anOid->length;
			inBufDesc.value = anOid->elements;
			outBufDesc.length = sizeof (hexMech);
			outBufDesc.value = hexMech;

			if (!gsscred_AsHex(&inBufDesc, &outBufDesc))
				continue;
		} else
			anOid = userMechOid;

		/* create a gss name */
		if (!gsscred_MakeName(anOid, name, nameOidStr, &outBufDesc))
			continue;

		/* now convert it to hex, and find it */
		searchName.value = hexName;
		searchName.length = sizeof (hexName);
		status = gsscred_AsHex(&outBufDesc, &searchName);
		free(outBufDesc.value);

		if (!status)
			continue;

		if (tableSource == GSSCRED_FLAT_FILE)
			file_getGssCredEntry(&searchName, uidStr, &errDetails);
		else {
			entryPtr = NULL;  /* other backends coming soon */
			while (entryPtr != NULL) {
				fprintf(stdout, "\n%s\t%d\t%s",
					entryPtr->principal_name,
					entryPtr->unix_uid, entryPtr->comment);
				free(entryPtr->principal_name);
				free(entryPtr->comment);
				entryTmpPtr = entryPtr->next;
				free(entryPtr);
				entryPtr = entryTmpPtr;
			}
		}

		/* any errors to display */
		if (errDetails) {
			fprintf(stderr,
				gettext("\nError searching gsscred table "
					"[%s]."),
				errDetails);
			free(errDetails);
			errDetails = NULL;
			status = 0;
		}
	}	/* for */

cleanup:
	if (mechSet != NULL)
		gss_release_oid_set(&minor, &mechSet);

	return (status);
}  /* listUsers */

/*
 * Performs additional handling while searching for users
 * stored in the flat file table.
 */
int
file_listUsers(const gss_OID mechOid, const char *unixUid,
		char **errDetails)
{
	gss_buffer_desc mechBufDesc = GSS_C_EMPTY_BUFFER,
		mechHexBufDesc = GSS_C_EMPTY_BUFFER;
	char mechBuf[128], mechHexBuf[256];

	if (mechOid != NULL) {
		/* must make the name header whic contains mech oid */
		mechBufDesc.value = (void *) mechBuf;
		mechBufDesc.length = sizeof (mechBuf);
		mechHexBufDesc.value = (void*) mechHexBuf;
		mechHexBufDesc.length = sizeof (mechHexBuf);

		if ((!gsscred_MakeNameHeader(mechOid, &mechBufDesc)) ||
			(!gsscred_AsHex(&mechBufDesc, &mechHexBufDesc))) {
			(*errDetails) = strdup(
					gettext("\nInternal error. "
					" Conversion to hex failed."));
			return (0);
		}

		return (file_getGssCredEntry(&mechHexBufDesc,
				unixUid, errDetails));
	}

	return (file_getGssCredEntry(NULL, unixUid, errDetails));
}  /* file_listUsers */


/*
 *  Handles the deletion of users.
 */
static int removeUsers(const char *name, const char *nameOidStr,
		const char *uidStr, const char *mechOidStr)
{
	char hexMech[256],
		hexName[(MAX_STR_LEN *2) + 1],
		*errDetails = NULL;
	gss_OID anOid = NULL, userMechOid = NULL;
	gss_OID_set mechSet = NULL;
	gss_buffer_desc inBufDesc = GSS_C_EMPTY_BUFFER,
		outBufDesc = GSS_C_EMPTY_BUFFER,
		searchName = GSS_C_EMPTY_BUFFER;
	int status = 0, numOfMechs, i;
	OM_uint32 minor;


	/* user deletion can only be performed by super user */
	if (getuid()) {

		fprintf(stderr,
			gettext("\nUser deletion requires"
				" root privileges."));
		return (0);
	}

	/* do we need to convert the mechanism oid? */
	if (mechOidStr != NULL) {
		if (__gss_mech_to_oid(mechOidStr, &userMechOid) !=
		GSS_S_COMPLETE) {
			fprintf(stderr,
				gettext("\nInvalid mechanism specified [%s]."),
				mechOidStr);
			return (0);
		}

		inBufDesc.length = userMechOid->length;
		inBufDesc.value = userMechOid->elements;
		outBufDesc.length = sizeof (hexMech);
		outBufDesc.value = hexMech;

		if (!gsscred_AsHex(&inBufDesc, &outBufDesc)) {
			fprintf(stderr,
				gettext("\nInternal error."
					"  Conversion to hex failed."));
			status = 0;
			goto cleanup;
		}

	}	 /* mechOidStr != NULL */

	/* are we deleting the entire table or an entire mech ? */
	if (name == NULL && uidStr == NULL) {

		if (tableSource == GSSCRED_FLAT_FILE)
			status = file_removeUsers(userMechOid,
					NULL, &errDetails);
		else
			status = 0;

		/* display any errors */
		if (errDetails) {
			fprintf(stderr,
				gettext("\nError deleting gsscred entry "
					"[%s]."),
				errDetails);
			free(errDetails);
			errDetails = NULL;
		}
		goto cleanup;
	}

	/* are we deleting by uid or uid and mech? */
	if (name == NULL && uidStr != NULL) {

		if (tableSource == GSSCRED_FLAT_FILE)
			status = file_removeUsers(userMechOid, uidStr,
						&errDetails);
		else
			status = 0;

		/* check for any errors */
		if (errDetails) {
			fprintf(stderr,
				gettext("\nError deleting gsscred entry "
					"[%s]."),
				errDetails);
			free(errDetails);
			errDetails = NULL;
		}
		goto cleanup;
	}

	/*
	 * We are deleting by name;
	 * how many mechs must we check?
	 */
	if (mechOidStr == NULL) {

		if (gss_indicate_mechs(&minor, &mechSet) != GSS_S_COMPLETE) {
			fprintf(stderr,
				gettext("\nInternal error.  "
					"GSS-API call failed."));
			status = 0;
			goto cleanup;
		}
		numOfMechs = mechSet->count;
	}
	else
		numOfMechs = 1;

	/* now look through all the mechs, deleting */
	for (i = 0; i < numOfMechs; i++) {

		if (mechOidStr == NULL) {
			anOid = &mechSet->elements[i];
			inBufDesc.length = anOid->length;
			inBufDesc.value = anOid->elements;
			outBufDesc.length = sizeof (hexMech);
			outBufDesc.value = hexMech;
			if (!gsscred_AsHex(&inBufDesc, &outBufDesc))
				continue;
		} else
			anOid = userMechOid;

		/* create a gss name */
		if (!gsscred_MakeName(anOid, name, nameOidStr, &outBufDesc))
			continue;

		/* now convert it to hex, and delete it */
		searchName.value = hexName;
		searchName.length = sizeof (hexName);
		status = gsscred_AsHex(&outBufDesc, &searchName);
		free(outBufDesc.value);

		if (!status)
			continue;

		if (tableSource == GSSCRED_FLAT_FILE)
			status = file_deleteGssCredEntry(&searchName,
					uidStr, &errDetails);
		else
			status = 0;

		/* check for any errors */
		if (errDetails) {
			fprintf(stderr,
				gettext("\nError deleting gsscred entry"
					" [%s]."),
				errDetails);
			free(errDetails);
			errDetails = NULL;
		}
	}	 /* for */

cleanup:
	if (mechSet != NULL)
		gss_release_oid_set(&minor, &mechSet);

	return (status);
}  /* removeUsers */


/*
 * Performs additional handling while deleting users
 * stored in the flat file table.
 */
int file_removeUsers(const gss_OID mechOid, const char *unixUid,
		char **errDetails)
{
	gss_buffer_desc mechBufDesc = GSS_C_EMPTY_BUFFER,
		mechHexBufDesc = GSS_C_EMPTY_BUFFER;
	char mechBuf[128], mechHexBuf[256];

	if (mechOid != NULL) {
		/*
		 * need to create the buffer header which contains
		 * the mechanism oid.
		 */
		mechBufDesc.value = (void*) mechBuf;
		mechBufDesc.length = sizeof (mechBuf);
		mechHexBufDesc.value = (void *) mechHexBuf;
		mechHexBufDesc.length = sizeof (mechHexBuf);

		if ((!gsscred_MakeNameHeader(mechOid, &mechBufDesc)) ||
		    (!gsscred_AsHex(&mechBufDesc, &mechHexBufDesc))) {
			(*errDetails) = strdup(
				gettext("\nInternal error."
					"  Conversion to hex failed."));
			return (0);
		}

		return (file_deleteGssCredEntry(&mechHexBufDesc, unixUid,
						errDetails));
	}

	return (file_deleteGssCredEntry(NULL, unixUid, errDetails));
}  /* file_removeUsers */


/*
 * Prints the usage string, and terminates.
 */
static void usage(void)
{

	fprintf(stderr,
		gettext("\nUsage:\t %s [-n user [-o oid] [-u uid]]"
			" [-c comment] -m mech -a"
			"\n\t %s [-n user [-o oid]] [-u uid] [-m mech] -r"
			"\n\t %s [-n user [-o oid]] [-u uid] [-m mech] -l\n"),
		PROG_NAME, PROG_NAME, PROG_NAME);
	exit(1);
}  /* usage */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1997-2002 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * gsscred utility
 *
 * Manages mapping between a security principal
 * name and unix uid.
 */

#ifndef	_GSSCRED_H
#define	_GSSCRED_H

#include <libintl.h>
#include <locale.h>
#include <gssapi/gssapi.h>
#include <pwd.h>

#ifdef	__cplusplus
extern "C" {
#endif

#if !defined(TEXT_DOMAIN)
#define	TEXT_DOMAIN "SUNW_OST_OSCMD"
#endif

#define	GSSCRED_FLAT_FILE	-1

/* Structure to hold GSS credentials for each entry */
typedef struct GssCredEntry_t {
	char *principal_name;
	int  unix_uid;
	char *comment;
	struct GssCredEntry_t *next;
} GssCredEntry;

/*
 * Misc functions in gsscred.
 */
int gsscred_AsHex(const gss_buffer_t inBuf, gss_buffer_t outBuf);
int gsscred_MakeName(const gss_OID mechOid, const char *name,
		const char *nameOid, gss_buffer_t OutName);
int gsscred_read_config_file(void);
int gsscred_MakeNameHeader(const gss_OID mechOid, gss_buffer_t outNameHdr);


/*
 * Flat file based gsscred functions.
 */
int file_addGssCredEntry(const gss_buffer_t hexName, const char *uid,
	const char *comment, char **errDetails);
int file_getGssCredEntry(const gss_buffer_t name, const char *uid,
	char **errDetails);
int file_deleteGssCredEntry(const gss_buffer_t name, const char *uid,
	char **errDetails);
int file_getGssCredUid(const gss_buffer_t name, uid_t *uidOut);


/*
 * GSS entry point for retrieving user uid information based on
 * exported name buffer.
 */
int gss_getGssCredEntry(const gss_buffer_t expName, uid_t *uid);

#ifdef	__cplusplus
}
#endif

#endif	/* _GSSCRED_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <ctype.h>
#include "gsscred.h"

/*
 *  gsscred utility
 *  Manages mapping between a security principal name and unix uid.
 *  Implementation file for the file based gsscred utility.
 */

#define	MAX_ENTRY_LEN 1024

static const char credFile[] = "/etc/gss/gsscred_db";
static const char credFileTmp[] = "/etc/gss/gsscred_db.tmp";
static const int expNameTokIdLen = 2;
static const int mechOidLenLen = 2;
static const int krb5OidTagLen = 1;
static const int krb5OidLenLen = 1;
static const int nameLen = 4;
static const int krb5OidLen = 9;

/*
 * Multiply by two given that the token has already gone through hex string
 * expansion.
 */
#define	NAME_OFFSET (expNameTokIdLen + mechOidLenLen + krb5OidTagLen + \
	krb5OidLenLen + krb5OidLen + nameLen) * 2

static int matchEntry(const char *entry, const gss_buffer_t name,
		const char *uid, uid_t *uidOut);

/*
 * file_addGssCredEntry
 *
 * Adds a new entry to the gsscred table.
 * Does not check for duplicate entries.
 */
int file_addGssCredEntry(const gss_buffer_t hexName, const char *uid,
		const char *comment, char **errDetails)
{
	FILE *fp;
	char tmpBuf[256];

	if ((fp = fopen(credFile, "a")) == NULL) {
		if (errDetails) {
			(void) snprintf(tmpBuf, sizeof (tmpBuf),
				gettext("Unable to open gsscred file [%s]"),
				credFile);
			*errDetails = strdup(tmpBuf);
		}
		return (0);
	}

	(void) fprintf(fp,
		    "%s\t%s\t%s\n", (char *)hexName->value, uid, comment);
	(void) fclose(fp);
	return (1);
}  /* *******  file_addGssCredEntry ****** */



/*
 * file_getGssCredEntry
 *
 * Searches the file for the file matching the name.  Since the name
 * contains a mechanism identifier, to search for all names for a given
 * mechanism just supply the mechanism portion in the name buffer.
 * To search by uid only, supply a non-null value of uid.
 */
int file_getGssCredEntry(const gss_buffer_t name, const char *uid,
		char **errDetails)
{
	FILE *fp;
	char entry[MAX_ENTRY_LEN+1];

	if ((fp = fopen(credFile, "r")) == NULL) {

		if (errDetails) {
			(void) snprintf(entry, sizeof (entry),
				gettext("Unable to open gsscred file [%s]"),
				credFile);
			*errDetails = strdup(entry);
		}

		return (0);
	}

	/* go through the file in sequential order */
	while (fgets(entry, MAX_ENTRY_LEN, fp) != NULL) {
		/* is there any search criteria */
		if (name == NULL && uid == NULL) {
			(void) fprintf(stdout, "%s", entry);
			continue;
		}

		if (matchEntry(entry, name, uid, NULL))
			(void) fprintf(stdout, "%s", entry);

	}	 /* while */

	(void) fclose(fp);
	return (1);
}  /* file_getGssCredEntry */

/*
 * file_getGssCredUid
 *
 * GSS entry point for retrieving user uid information.
 * We need to go through the entire file to ensure that
 * the last matching entry is retrieved - this is because
 * new entries are added to the end, and in case of
 * duplicates we want to get the latest entry.
 */
int
file_getGssCredUid(const gss_buffer_t expName, uid_t *uidOut)
{
	FILE *fp;
	char entry[MAX_ENTRY_LEN+1];
	int retVal = 0;

	if ((fp = fopen(credFile, "r")) == NULL)
		return (0);

	/* go through the entire file in sequential order */
	while (fgets(entry, MAX_ENTRY_LEN, fp) != NULL) {
		if (matchEntry(entry, expName, NULL, uidOut)) {
			retVal = 1;
		}
	} /* while */

	(void) fclose(fp);
	return (retVal);
} /* file_getGssCredUid */



/*
 *
 * file_deleteGssCredEntry
 *
 * removes entries form file that match the delete criteria
 */
int file_deleteGssCredEntry(const gss_buffer_t name, const char *uid,
		char **errDetails)
{
	FILE *fp, *tempFp;
	char entry[MAX_ENTRY_LEN+1];
	int foundOne = 0;

	/* are we deleting everyone? */
	if (name == NULL && uid == NULL) {

		if ((fp = fopen(credFile, "w")) == NULL) {

			if (errDetails) {
				(void) snprintf(entry, sizeof (entry),
					gettext("Unable to open gsscred"
						" file [%s]"),
					credFile);
				*errDetails = strdup(entry);
			}
			return (0);
		}

		(void) fclose(fp);
		return (1);
	}

	/* selective delete - might still be everyone */
	if ((fp = fopen(credFile, "r")) == NULL) {

		if (errDetails) {
			(void) snprintf(entry, sizeof (entry),
				gettext("Unable to open gsscred file [%s]"),
				credFile);
			*errDetails = strdup(entry);
		}
		return (0);
	}

	/* also need to open temp file */
	if ((tempFp = fopen(credFileTmp, "w")) == NULL) {
		if (errDetails) {
			(void) snprintf(entry, sizeof (entry),
				gettext("Unable to open gsscred temporary"
					" file [%s]"),
				credFileTmp);
			*errDetails = strdup(entry);
		}

		(void) fclose(fp);
		return (0);
	}

	/* go through all the entries sequentially removing ones that match */
	while (fgets(entry, MAX_ENTRY_LEN, fp) != NULL) {

		if (!matchEntry(entry, name, uid, NULL))
			(void) fputs(entry, tempFp);
		else
			foundOne = 1;
	}
	(void) fclose(tempFp);
	(void) fclose(fp);

	/* now make the tempfile the gsscred file */
	(void) rename(credFileTmp, credFile);
	(void) unlink(credFileTmp);

	if (!foundOne) {
		*errDetails = strdup(gettext("No users found"));
		return (0);
	}
	return (1);
}  /* file_deleteGssCredEntry */



/*
 *
 * match entry
 *
 * checks if the specified entry matches the supplied criteria
 * returns 1 if yes, 0 if no
 * uidOut value can be used to retrieve the uid from the entry
 * when the uid string is passed in, the uidOut value is not set
 */
static int matchEntry(const char *entry, const gss_buffer_t name,
		const char *uid, uid_t *uidOut)
{
	char fullEntry[MAX_ENTRY_LEN+1], *item, *item_buf, *name_buf;
	char dilims[] = "\t \n";
	/*
	 * item_len is the length of the token in the gsscred_db.
	 * name_len is the length of the token passed to this function.
	 */
	int item_len, name_len;
	/*
	 * This is the hex encoding of the beginning of all exported name
	 * tokens for the Kerberos V mechanism.  We need this to detect old,
	 * incorrectly exported name tokens; see below.
	 */
	char *krb5_ntok_prefix = "0401000B06092A864886F712010202";
	/*
	 * This is the hex encoded GSS_C_NT_USER_NAME OID, needed for the same
	 * reason as krb5_ntok_prefix.
	 */
	char *gss_u_name = "2A864886F71201020101";

	if (entry == NULL || isspace(*entry))
		return (0);

	/* save the entry since strtok will chop it up */
	(void) strcpy(fullEntry, entry);

	if ((item = strtok(fullEntry, dilims)) == NULL)
		return (0);

	/* do we need to search the name */
	if (name != NULL) {

		item_len = strlen(item);
		name_len = name->length;
		name_buf = name->value;

		/* we can match the prefix of the string */
		if (item_len < name_len)
			return (0);

		if (strncmp(item, name->value, name_len) != 0) {

			/*
			 * The following section is needed in order to detect
			 * two existing errant formats in the gsscred db.
			 *
			 * 1. Exported names that have a trailing null byte
			 * ("00" in two hex characters) with the name length
			 * incremented to account for the extra null byte.
			 *
			 * 2. Exported names that have the name type length
			 * and name type OID prepended to the exported name.
			 *
			 */
			if (strncmp(name->value, krb5_ntok_prefix,
			    strlen(krb5_ntok_prefix)) != 0)
				return (0);

			if (strncmp(item, krb5_ntok_prefix,
			    strlen(krb5_ntok_prefix)) != 0)
				return (0);

			if ((item_buf = strstr(item, gss_u_name)) == NULL)
				return (0);

			item_buf += strlen(gss_u_name);

			name_buf += NAME_OFFSET;

			if ((strlen(item_buf) != strlen(name_buf)) &&
			    (strncmp(item_buf + (strlen(item_buf) - 2), "00", 2)
			    != 0))
				return (0);

			/*
			 * Here we compare the end of name_len, given
			 * that item_len could have two extra "00"
			 * representing the null byte.
			 */
			if (strncmp(item_buf, name_buf, name_len - NAME_OFFSET)
			    != 0)
				return (0);
		} else
			/*
			 * We only strncmp() so we could check for old,
			 * broken exported name tokens for the krb5 mech.
			 * For any other exported name tokens we want exact
			 * matches only.
			 */
			if (item_len != name_len)
				return (0);

		/* do we need to check the uid - if not then we found it */
		if (uid == NULL) {
			/* do we ned to parse out the uid ? */
			if (uidOut) {
				if ((item = strtok(NULL, dilims)) == NULL)
					return (0);
				*uidOut = atol(item);
			}
			return (1);
		}

		/* continue with checking the uid */
	}

	if (uid == NULL)
		return (1);

	/* get the next token from the string - the uid */
	if ((item = strtok(NULL, dilims)) == NULL)
		return (0);

	if (strcmp(item, uid) == 0)
		return (1);

	return (0);
}  /* *******  matchEntry ****** */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *
 *  gsscred utility
 *  Manages mapping between a security principal name and unix uid
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <ctype.h>
#include "gsscred.h"

/* From g_glue.c */

extern int
get_der_length(unsigned char **, unsigned int, unsigned int *);

extern unsigned int
der_length_size(unsigned int);

extern int
put_der_length(unsigned int, unsigned char **, unsigned int);



/*
 * GSS export name constants
 */
static const char *expNameTokId = "\x04\x01";
static const int expNameTokIdLen = 2;
static const int mechOidLenLen = 2;
static const int mechOidTagLen = 1;


/*
 * Internal utility routines.
 */

/*
 * gsscred_read_config_file
 *
 * function to read the optional gsscred configuration file
 * which specifies which backend to use to store the gsscred
 * table.
 *
 * we now only support flat files (btw, this file for backend is Obsoleted
 * by PSARC)
 */
int
gsscred_read_config_file(void)
{
	return (GSSCRED_FLAT_FILE);
} /* gsscred_read_config_file */


/*
 * gsscred_MakeName
 *
 * construct a principal name in the GSS_C_NT_EXPORT_NAME format.
 */
int gsscred_MakeName(const gss_OID mechOid, const char *name,
		const char *nameOidStr, gss_buffer_t nameOut)
{
	gss_OID nameOid;
	gss_name_t intName;
	OM_uint32 minor, major;
	gss_buffer_desc aName = GSS_C_EMPTY_BUFFER, oidStr;

	nameOut->length = 0;
	nameOut->value = NULL;

	/* we need to import the name, then canonicalize it, then export it */
	if (nameOidStr == NULL)
		nameOid = (gss_OID)GSS_C_NT_USER_NAME;
	else {
		oidStr.length = strlen(nameOidStr);
		oidStr.value = (void *)nameOidStr;
		if (gss_str_to_oid(&minor, &oidStr, &nameOid) !=
			GSS_S_COMPLETE) {
			(void) fprintf(stderr,
				gettext("\nInvalid name oid supplied [%s].\n"),
				nameOidStr);
			return (0);
		}
	}

	/* first import the name */
	aName.length = strlen(name);
	aName.value = (void*)name;
	major = gss_import_name(&minor, &aName, nameOid, &intName);
	if (nameOidStr != NULL) {
		free(nameOid->elements);
		free(nameOid);
	}

	if (major != GSS_S_COMPLETE) {
		(void) fprintf(stderr,
			gettext("\nInternal error importing name [%s].\n"),
			name);
		return (0);
	}

	/* now canonicalize the name */
	if (gss_canonicalize_name(&minor, intName, mechOid, NULL)
	    != GSS_S_COMPLETE) {
		(void) fprintf(stderr,
			gettext("\nInternal error canonicalizing name"
				" [%s].\n"),
			name);
		(void) gss_release_name(&minor, &intName);
		return (0);
	}

	/* now convert to export format */
	if (gss_export_name(&minor, intName, nameOut) != GSS_S_COMPLETE) {
		(void) fprintf(stderr,
			gettext("\nInternal error exporting name [%s].\n"),
			name);
		(void) gss_release_name(&minor, &intName);
		return (0);
	}

	(void) gss_release_name(&minor, &intName);
	return (1);
} /* *******  makeName ****** */


/*
 * Constructs a part of the GSS_NT_EXPORT_NAME
 * Only the mechanism independent name part is created.
 */
int
gsscred_MakeNameHeader(const gss_OID mechOid, gss_buffer_t outNameHdr)
{
	unsigned char *buf = NULL;
	int mechOidDERLength, mechOidLength;

	/* determine the length of buffer needed */
	mechOidDERLength = der_length_size(mechOid->length);
	outNameHdr->length = mechOidLenLen + mechOidTagLen +
		mechOidDERLength + expNameTokIdLen + mechOid->length;
	if ((outNameHdr->value = (void*)malloc(outNameHdr->length)) == NULL) {
		outNameHdr->length = 0;
		return (0);
	}

	/* start by putting the token id */
	buf = (unsigned char *) outNameHdr->value;
	(void) memset(outNameHdr->value, '\0', outNameHdr->length);
	(void) memcpy(buf, expNameTokId, expNameTokIdLen);
	buf += expNameTokIdLen;

	/*
	 * next 2 bytes contain the mech oid length (includes
	 * DER encoding)
	 */
	mechOidLength =  mechOidTagLen + mechOidDERLength +
				mechOid->length;

	*buf++ = (mechOidLength & 0xFF00) >> 8;
	*buf++ = (mechOidLength & 0x00FF);
	*buf++ = 0x06;
	if (put_der_length(mechOid->length, &buf,
		mechOidDERLength) != 0) {
		/* free the buffer */
		free(outNameHdr->value);
		return (0);
	}

	/* now add the mechanism oid */
	(void) memcpy(buf, mechOid->elements, mechOid->length);

	/* we stop here because the rest is mechanism specific */
	return (1);
} /* gsscred_MakeNameHeader */


/*
 * Converts the supplied string to HEX.
 * The passed in buffer must be twice as long as the input buffer.
 * Long form is used (i.e. '\0' will become '00').  This is needed
 * to enable proper re-parsing of names.
 */
int
gsscred_AsHex(gss_buffer_t dataIn, gss_buffer_t dataOut)
{
	int i;
	char *out, *in;
	unsigned int tmp;

	if (dataOut->length < ((dataIn->length *2) + 1))
		return (0);

	out = (char *)dataOut->value;
	in = (char *)dataIn->value;
	dataOut->length = 0;

	for (i = 0; i < dataIn->length; i++) {
		tmp = (unsigned int)(*in++)&0xff;
		(void) sprintf(out, "%02X", tmp);
		out++;
		out++;
	}
	dataOut->length = out - (char *)dataOut->value;
	*out = '\0';

	return (1);
} /* ******* gsscred_AsHex ******* */


/*
 * GSS entry point for retrieving user uid mappings.
 * The name buffer contains a principal name in exported format.
 */
int
gss_getGssCredEntry(const gss_buffer_t expName, uid_t *uid)
{
	int tableSource;
	unsigned char *buf;
	gss_buffer_desc mechOidDesc = GSS_C_EMPTY_BUFFER,
		mechHexOidDesc = GSS_C_EMPTY_BUFFER,
		expNameHexDesc = GSS_C_EMPTY_BUFFER;
	char oidHexBuf[256], expNameHexBuf[1024];
	unsigned int dummy;
	int len;

	tableSource = gsscred_read_config_file();

	/*
	 * for xfn (ldap?), we must first construct, a hex mechansim oid string
	 */
	if (expName->length < (expNameTokIdLen + mechOidLenLen +
					mechOidTagLen))
	    return (0);

	buf = (unsigned char *)expName->value;
	buf += expNameTokIdLen;

	/* skip oid length - get to der */
	buf++;
	buf++;

	/* skip oid tag */
	buf++;

	/* get oid length */
	len = get_der_length(&buf,
			(expName->length - expNameTokIdLen
			- mechOidLenLen - mechOidTagLen), &dummy);
	if (len  == -1)
		return (0);
	else
		mechOidDesc.length = len;

	if (expName->length <
		(expNameTokIdLen + mechOidLenLen + mechOidDesc.length
			+  dummy+ mechOidTagLen))
		return (0);

	mechOidDesc.value = (void *)buf;

	/* convert the oid buffer to hex */
	mechHexOidDesc.value = (void*) oidHexBuf;
	mechHexOidDesc.length = sizeof (oidHexBuf);
	if (!gsscred_AsHex(&mechOidDesc, &mechHexOidDesc))
		return (0);

	/* also need to convert the name buffer into hex */
	expNameHexDesc.value = expNameHexBuf;
	expNameHexDesc.length = sizeof (expNameHexBuf);
	if (!gsscred_AsHex(expName, &expNameHexDesc))
		return (0);

	if (tableSource == GSSCRED_FLAT_FILE)
		return (file_getGssCredUid(&expNameHexDesc, uid));

	return (0);  /* XXX for new backends (ldap, dss), 0->1 probably */
} /* gss_getGssCredEntry */