path: root/lib/libtdekrb/src/tdekrbclientsocket.cpp

/***************************************************************************
 *   Copyright (C) 2012 by Timothy Pearson                                 *
 *   kb9vqf@pearsoncomputing.net                                           *
 *                                                                         *
 *   This program is free software; you can redistribute it and/or modify  *
 *   it under the terms of the GNU General Public License as published by  *
 *   the Free Software Foundation; either version 2 of the License, or     *
 *   (at your option) any later version.                                   *
 *                                                                         *
 *   This program is distributed in the hope that it will be useful,       *
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
 *   GNU General Public License for more details.                          *
 *                                                                         *
 *   You should have received a copy of the GNU General Public License     *
 *   along with this program; if not, write to the                         *
 *   Free Software Foundation, Inc.,                                       *
 *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
 ***************************************************************************/

#include <stdlib.h>
#include <unistd.h>

#include <tqapplication.h>
#include <tqbuffer.h>

#include <sasl.h>
#include <saslplug.h>
#include <saslutil.h>

#include "tdekrbclientsocket.h"

#define NET_SEC_BUF_SIZE (2048)

/* exception handling */
struct exit_exception {
	int c;
	exit_exception(int c):c(c) { }
};

class SASLDataPrivate
{
	public:
		sasl_callback_t m_callbacks[N_CALLBACKS];
		sasl_conn_t *m_krbConnection;
};

static const char * safe_sasl_errdetail(sasl_conn_t *conn) {
	const char * str = sasl_errdetail(conn);
	if (str) {
		return str;
	}
	else {
		return "unknown error";
	}
}

static int logSASLMessages(void *context __attribute__((unused)), int priority, const char *message) {
	const char *label;

	if (!message) {
		return SASL_BADPARAM;
	}

	switch (priority) {
		case SASL_LOG_ERR:
			label = "Error";
			break;
		case SASL_LOG_NOTE:
			label = "Info";
			break;
		default:
			label = "Other";
			break;
	}

	printf("[SASL %s] %s\n\r", label, message);

	return SASL_OK;
}

TDEKerberosClientSocket::TDEKerberosClientSocket(TQObject *parent, const char *name) : TQSocket(parent, name), m_kerberosRequested(false), m_criticalSection(0), m_bufferLength(0), m_negotiatedMaxBufferSize(NET_SEC_BUF_SIZE) {
	saslData = new SASLDataPrivate;
	saslData->m_krbConnection = NULL;
	m_buffer = new TQBuffer();
	m_buffer->open(IO_ReadWrite|IO_Truncate);
}

TDEKerberosClientSocket::~TDEKerberosClientSocket() {
	m_buffer->close();
	delete m_buffer;
	delete saslData;
}

bool TDEKerberosClientSocket::open(int mode) {
	bool ret = TQSocket::open(mode);
	if (m_kerberosRequested) {
		initializeKerberosInterface();
	}
	return ret;
}

void TDEKerberosClientSocket::close() {
	TQSocket::close();
	if (m_criticalSection > 0) {
		throw exit_exception(-1);
	}
}

void TDEKerberosClientSocket::flush() {
	if (m_kerberosRequested) {
		// FIXME
		// If a write buffer is implemented, it will need to be flushed before the following call is made
		TQSocket::flush();
	}
	else {
		TQSocket::flush();
	}
}

TQIODevice::Offset TDEKerberosClientSocket::size() const {
	TQIODevice::Offset ret;

	if (m_kerberosRequested) {
		ret = m_bufferLength;
	}
	else {
		ret = TQSocket::size();
	}

	return ret;
}

TQIODevice::Offset TDEKerberosClientSocket::at() const {
	return TQSocket::at();
}

bool TDEKerberosClientSocket::at(TQIODevice::Offset off) {
	long i;
	bool ret;

	if (m_kerberosRequested) {
		if (off > 0) {
			// Prevent overflow
			if (off > (unsigned long)m_bufferLength) {
				off = m_bufferLength;
			}

			// Remove the specified bytes from the buffer
			m_bufferLength = m_bufferLength-off;
			TQByteArray ba = m_buffer->buffer();
			for (i=0; i<m_bufferLength;i++) {
				ba[i] = ba[i+off];
			}
			if (m_bufferLength < 1) {
				// Clear the buffer from memory
				m_buffer->close();
				m_buffer->open(IO_ReadWrite|IO_Truncate);
			}
		}
		return true;
	}
	else {
		ret = TQSocket::at(off);
	}

	return ret;
}

bool TDEKerberosClientSocket::atEnd() const {
	bool ret;

	if (m_kerberosRequested) {
		return (m_buffer->at() >= (unsigned long)m_bufferLength);
	}
	else {
		ret = TQSocket::atEnd();
	}

	return ret;
}

int TDEKerberosClientSocket::setUsingKerberos(bool krbactive) {
	int ret = 0;

	if (m_serviceName == "") {
		printf("[ERROR] No service name set!\n\r"); fflush(stdout);
		return -1;
	}

	if (krbactive) {
		m_kerberosRequested = true;
		if ((!saslData->m_krbConnection) && (state() == TQSocket::Connected)) {
			ret = initializeKerberosInterface();
		}
	}
	else {
		m_kerberosRequested = false;
		if (saslData->m_krbConnection) {
			freeKerberosConnection();
		}
	}

	return ret;
}

void TDEKerberosClientSocket::setServiceName(TQString name) {
	m_serviceName = name;
}

void TDEKerberosClientSocket::setServerFQDN(TQString name) {
	m_serverFQDN = name;
}

TQ_LONG TDEKerberosClientSocket::readBlock(char *data, TQ_ULONG maxlen) {
	long i;
	TQ_LONG ret;

	if (m_kerberosRequested) {
		int reclen;
		int wrlen;
		char* buf = (char*)malloc(m_negotiatedMaxBufferSize);
		reclen = receiveEncryptedData(buf, m_negotiatedMaxBufferSize);
		m_buffer->at(m_bufferLength);
		wrlen = m_buffer->writeBlock(buf, reclen);
		if (wrlen > 0) {
			m_bufferLength = m_bufferLength + wrlen;
		}
		free(buf);

		m_buffer->at(0);
		ret = m_buffer->readBlock(data, maxlen);
		if (ret > 0) {
			// Remove the read bytes from the buffer
			m_bufferLength = m_bufferLength-ret;
			TQByteArray ba = m_buffer->buffer();
			for (i=0; i<m_bufferLength;i++) {
				ba[i] = ba[i+ret];
			}
			if (m_bufferLength < 1) {
				// Clear the buffer from memory
				m_buffer->close();
				m_buffer->open(IO_ReadWrite|IO_Truncate);
			}
		}
	}
	else {
		ret = TQSocket::readBlock(data, maxlen);
	}

	return ret;
}

TQ_LONG TDEKerberosClientSocket::writeBlock(const char *data, TQ_ULONG len) {
	TQ_LONG ret;

	if (m_kerberosRequested) {
		ret = transmitEncryptedData(socket(), data, len);
	}
	else {
		ret = TQSocket::writeBlock(data, len);
	}

	return ret;
}

TQ_LONG TDEKerberosClientSocket::readLine(char *data, TQ_ULONG maxlen) {
	long i;
	TQ_LONG ret;

	if (m_kerberosRequested) {
		int reclen;
		int wrlen;
		char* buf = (char*)malloc(m_negotiatedMaxBufferSize);
		reclen = receiveEncryptedData(buf, m_negotiatedMaxBufferSize);
		m_buffer->at(m_bufferLength);
		wrlen = m_buffer->writeBlock(buf, reclen);
		if (wrlen > 0) {
			m_bufferLength = m_bufferLength + wrlen;
		}
		free(buf);

		m_buffer->at(0);
		ret = m_buffer->readLine(data, maxlen);
		if (ret > 0) {
			// Remove the read bytes from the buffer
			m_bufferLength = m_bufferLength-ret;
			TQByteArray ba = m_buffer->buffer();
			for (i=0; i<m_bufferLength;i++) {
				ba[i] = ba[i+ret];
			}
			if (m_bufferLength < 1) {
				// Clear the buffer from memory
				m_buffer->close();
				m_buffer->open(IO_ReadWrite|IO_Truncate);
			}
		}
	}
	else {
		ret = TQSocket::readLine(data, maxlen);
	}

	return ret;
}

TQString TDEKerberosClientSocket::readLine() {
	long i;
	TQString ret;

	if (m_kerberosRequested) {
		int reclen;
		int wrlen;
		int readlen;
		char* buf = (char*)malloc(m_negotiatedMaxBufferSize);
		reclen = receiveEncryptedData(buf, m_negotiatedMaxBufferSize);
		m_buffer->at(m_bufferLength);
		wrlen = m_buffer->writeBlock(buf, reclen);
		if (wrlen > 0) {
			m_bufferLength = m_bufferLength + wrlen;
		}
		free(buf);

		m_buffer->at(0);
		buf = (char*)malloc(m_negotiatedMaxBufferSize);
		readlen = m_buffer->readLine(buf, m_negotiatedMaxBufferSize);
		if (readlen > 0) {
			// Remove the read bytes from the buffer
			m_bufferLength = m_bufferLength-readlen;
			TQByteArray ba = m_buffer->buffer();
			for (i=0; i<m_bufferLength;i++) {
				ba[i] = ba[i+readlen];
			}
			if (m_bufferLength < 1) {
				// Clear the buffer from memory
				m_buffer->close();
				m_buffer->open(IO_ReadWrite|IO_Truncate);
			}
			ret = TQString(buf);
		}
		else {
			ret == TQString::null;
		}
		free(buf);
	}
	else {
		ret = TQSocket::readLine();
	}

	return ret;
}

void TDEKerberosClientSocket::writeLine(TQString str) {
	if (m_kerberosRequested) {
		transmitEncryptedData(socket(), str.ascii(), str.length());
	}
	else {
		TQSocket::writeBlock(str.ascii(), str.length());
	}
}

void TDEKerberosClientSocket::freeKerberosConnection(void) {
	if (saslData->m_krbConnection) {
		sasl_dispose(&saslData->m_krbConnection);
	}
	saslData->m_krbConnection = 0;
}

void TDEKerberosClientSocket::sendSASLDataToNetwork(const char *buffer, unsigned length, int netfd) {
	char *buf;
	unsigned len, alloclen;
	int result;

	alloclen = ((length / 3) + 1) * 4 + 1;
	buf = (char*)malloc(alloclen);
	if (!buf) {
		printf("[ERROR] Unable to malloc()!\n\r");
		return;
	}

	result = sasl_encode64(buffer, length, buf, alloclen, &len);
	if (result != SASL_OK) {
		printf("[ERROR] Encoding data in base64 returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
		return;
	}

	len = strlen(buf);
	buf[len] = '\n';
	buf[len+1] = 0;
	if (write(netfd, buf, len+1) < 0) {
		// ERROR
	}

	free(buf);
}

int TDEKerberosClientSocket::getSASLDataFromNetwork(char *buf, int trunclen) {
	m_criticalSection++;
	try {
		unsigned int len;
		int result;
	
		TQByteArray ba(2048);
	
		len = 0;
		while (1) {
			tqApp->processEvents();
			if (state() != TQSocket::Connected) {
				m_criticalSection--;
				return -1;
			}
			if (TQSocket::readBlock(ba.data()+len, 1) > 0) {
				if (ba.data()[len] == '\n') {
					ba.data()[len] = 0;
					break;
				}
				if (ba.data()[len] != '\r') {
					len++;
				}
			}
			else {
				usleep(1000);
			}
			if (len >= (ba.size()-1)) {
				ba.resize(ba.size()+2048);
			}
		}
	
		len = strlen(ba.data());
		result = sasl_decode64(ba.data(), strlen(ba.data()), buf, trunclen, &len);
		if (result != SASL_OK) {
			printf("[ERROR] Decoding data from base64 returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
			m_criticalSection--;
			return -1;
		}
		buf[len] = '\0';

		m_criticalSection--;
		return len;
	}
	catch(exit_exception& e) {
		m_criticalSection--;
		return -1;
	}
}

int TDEKerberosClientSocket::transmitEncryptedData(int fd, const char* readbuf, int cc) {
	int result = 0;
	unsigned int len;
	const char *data;

	result=sasl_encode(saslData->m_krbConnection, readbuf, cc, &data, &len);
	if (result != SASL_OK) {
		printf("[ERROR] Encrypting data returned %s (%d)\n\r", safe_sasl_errdetail(saslData->m_krbConnection), result);
		return -1;
	}
	sendSASLDataToNetwork(data, len, fd);

	return 0;
}

int TDEKerberosClientSocket::receiveEncryptedData(char *buf, unsigned int trunclen) {
	unsigned int recv_len;
	const char *recv_data;
	int result;
	int len;

	char *encbuf = (char*)malloc(m_negotiatedMaxBufferSize);
	len = getSASLDataFromNetwork(encbuf, m_negotiatedMaxBufferSize);
	if (len < 0) {
		return -1;
	}
	if (len >= 0) {
		result=sasl_decode(saslData->m_krbConnection, encbuf, len, &recv_data, &recv_len);
		if (result != SASL_OK) {
			free(encbuf);
			printf("[ERROR] Decrypting data returned %s (%d)\n\r", safe_sasl_errdetail(saslData->m_krbConnection), result);
			return -1;
		}
		if (recv_len > trunclen) {
			recv_len = trunclen;
		}
		memcpy(buf, recv_data, recv_len);
	}

	free(encbuf);
	return recv_len;
}

int TDEKerberosClientSocket::initializeKerberosInterface() {
	if (state() != TQSocket::Connected) {
		saslData->m_krbConnection = false;
		return -1;
	}

	sasl_callback_t *callback;
	char buf[NET_SEC_BUF_SIZE];
	int result = 0;
	int serverlast = 0;
	sasl_security_properties_t secprops;
	const char *chosenmech;
	unsigned int len;
	int slen;
	const char *data;
	sasl_ssf_t *ssf;
	char *iplocal = NULL;
	char *ipremote = NULL;
	const char *service = m_serviceName.ascii();
	const char *fqdn = m_serverFQDN.ascii();

	callback = saslData->m_callbacks;

	// log
	callback->id = SASL_CB_LOG;
	callback->proc = (sasl_callback_ft)&logSASLMessages;
	callback->context = NULL;
	++callback;

	// end of callback list
	callback->id = SASL_CB_LIST_END;
	callback->proc = NULL;
	callback->context = NULL;
	++callback;

	// Initialize default data structures
	memset(&secprops, 0L, sizeof(secprops));
	secprops.maxbufsize = NET_SEC_BUF_SIZE;
	secprops.max_ssf = UINT_MAX;

	result = sasl_client_init(saslData->m_callbacks);
	if (result != SASL_OK) {
		printf("[ERROR] Initializing libsasl returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
		return -1;
	}

	result = sasl_client_new(service, fqdn, iplocal, ipremote, NULL, serverlast, &saslData->m_krbConnection);
	if (result != SASL_OK) {
		printf("[ERROR] Allocating sasl connection state returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
		return -1;
	}

	result = sasl_setprop(saslData->m_krbConnection, SASL_SEC_PROPS, &secprops);
	if (result != SASL_OK) {
		printf("[ERROR] Setting security properties returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
		freeKerberosConnection();
		return -1;
	}

	printf("[DEBUG] Waiting for mechanism list from server...\n\r");
	slen = getSASLDataFromNetwork(buf, NET_SEC_BUF_SIZE);
	if (slen < 0) {
		return -2;
	}
	len = slen;

	printf("Choosing best mechanism from: %s\n", buf);

	result = sasl_client_start(saslData->m_krbConnection, buf, NULL, &data, &len, &chosenmech);
	if (result != SASL_OK && result != SASL_CONTINUE) {
		printf("[ERROR] Starting SASL negotiation returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
		freeKerberosConnection();
		return -1;
	}

	printf("[DEBUG] Using mechanism %s\n\r", chosenmech);
	strcpy(buf, chosenmech);
	if (data) {
		if (NET_SEC_BUF_SIZE - strlen(buf) - 1 < len) {
			printf("[ERROR] Insufficient buffer space to construct initial response!\n\r");
			freeKerberosConnection();
			return -1;
		}
		printf("[DEBUG] Preparing initial response...\n\r");
		memcpy(buf + strlen(buf) + 1, data, len);
		len += (unsigned) strlen(buf) + 1;
		data = NULL;
	}
	else {
		len = (unsigned) strlen(buf);
	}

	printf("[DEBUG] Sending initial response...\n\r");
	sendSASLDataToNetwork(buf, len, socket());

	while (result == SASL_CONTINUE) {
		printf("[DEBUG] Waiting for server reply...\n\r");
		slen = getSASLDataFromNetwork(buf, NET_SEC_BUF_SIZE);
		if (slen < 0) {
			return -2;
		}
		len = slen;
		result = sasl_client_step(saslData->m_krbConnection, buf, len, NULL, &data, &len);
		if (result != SASL_OK && result != SASL_CONTINUE) {
			printf("[ERROR] Performing SASL negotiation returned %s (%d)\n\r", sasl_errstring(result, NULL, NULL), result);
			freeKerberosConnection();
			return -1;
		}
		if (data && len) {
			printf("[DEBUG] Sending response...\n\r");
			sendSASLDataToNetwork(data, len, socket());
		}
		else if (result != SASL_OK || !serverlast) {
			sendSASLDataToNetwork("", 0, socket());
		}
	}
	printf("[DEBUG] Negotiation complete!\n\r");

	result = sasl_getprop(saslData->m_krbConnection, SASL_USERNAME, (const void **)&data);
	if (result != SASL_OK) {
		printf("[WARNING] Unable to determine authenticated username!\n\r");
	}
	else {
		printf("[DEBUG] Authenticated username: %s\n\r", data ? data : "(NULL)");
	}

	result = sasl_getprop(saslData->m_krbConnection, SASL_DEFUSERREALM, (const void **)&data);
	if (result != SASL_OK) {
		printf("[WARNING] Unable to determine authenticated realm!\n\r");
	}
	else {
		printf("[DEBUG] Authenticated realm: %s\n\r", data ? data : "(NULL)");
	}

	result = sasl_getprop(saslData->m_krbConnection, SASL_SSF, (const void **)&ssf);
	if (result != SASL_OK) {
		printf("[WARNING] Unable to determine SSF!\n\r");
	}
	else {
		printf("[DEBUG] Authenticated SSF: %d\n", *ssf);
	}

	result = sasl_getprop(saslData->m_krbConnection, SASL_MAXOUTBUF, (const void **)&m_negotiatedMaxBufferSize);
	if (result != SASL_OK) {
		printf("[WARNING] Unable to determine maximum buffer size!\n\r");
		m_negotiatedMaxBufferSize = NET_SEC_BUF_SIZE;
	}
	else {
		printf("[DEBUG] Maximum buffer size: %d\n", m_negotiatedMaxBufferSize);
	}

	return 0;
}