/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


/*
 * lib/kdb/kdb_ldap/kdb_ldap_conn.c
 *
 * Copyright (c) 2004-2005, Novell, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 *   * Redistributions of source code must retain the above copyright notice,
 *       this list of conditions and the following disclaimer.
 *   * Redistributions in binary form must reproduce the above copyright
 *       notice, this list of conditions and the following disclaimer in the
 *       documentation and/or other materials provided with the distribution.
 *   * The copyright holder's name is not used to endorse or promote products
 *       derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include "autoconf.h"
#if HAVE_UNISTD_H
#include <unistd.h>
#endif

#include "ldap_main.h"
#include "ldap_service_stash.h"
#include <kdb5.h>
#include <libintl.h>

static krb5_error_code
krb5_validate_ldap_context(krb5_context context, krb5_ldap_context *ldap_context)
{
    krb5_error_code             st=0;
    unsigned char               *password=NULL;

    if (ldap_context->bind_dn == NULL) {
	st = EINVAL;
	/* Solaris Kerberos: Keep error messages consistent */
	krb5_set_error_message(context, st, gettext("LDAP bind dn value missing"));
	goto err_out;
    }

    if (ldap_context->bind_pwd == NULL && ldap_context->service_password_file == NULL) {
	st = EINVAL;
	/* Solaris Kerberos: Keep error messages consistent */
	krb5_set_error_message(context, st, gettext("LDAP bind password value missing"));
	goto err_out;
    }

    if (ldap_context->bind_pwd == NULL && ldap_context->service_password_file !=
	NULL && ldap_context->service_cert_path == NULL) {
	if ((st=krb5_ldap_readpassword(context, ldap_context, &password)) != 0) {
	    prepend_err_str(context, gettext("Error reading password from stash: "), st, st);
	    goto err_out;
	}

	/* Check if the returned 'password' is actually the path of a certificate */
	if (!strncmp("{FILE}", (char *)password, 6)) {
	    /* 'password' format: <path>\0<password> */
	    ldap_context->service_cert_path = strdup((char *)password + strlen("{FILE}"));
	    if (ldap_context->service_cert_path == NULL) {
		st = ENOMEM;
		krb5_set_error_message(context, st, gettext("Error: memory allocation failed"));
		goto err_out;
	    }
	    if (password[strlen((char *)password) + 1] == '\0')
		ldap_context->service_cert_pass = NULL;
	    else {
		ldap_context->service_cert_pass = strdup((char *)password +
							 strlen((char *)password) + 1);
		if (ldap_context->service_cert_pass == NULL) {
		    st = ENOMEM;
		    krb5_set_error_message(context, st, gettext("Error: memory allocation failed"));
		    goto err_out;
		}
	    }
	    free(password);
	} else {
	    ldap_context->bind_pwd = (char *)password;
	    if (ldap_context->bind_pwd == NULL) {
		st = EINVAL;
		krb5_set_error_message(context, st, gettext("Error reading password from stash"));
		goto err_out;
	    }
	}
    }

    /* NULL password not allowed */
    if (ldap_context->bind_pwd != NULL && strlen(ldap_context->bind_pwd) == 0) {
	st = EINVAL;
	krb5_set_error_message(context, st, gettext("Service password length is zero"));
	goto err_out;
    }

err_out:
    return st;
}

/*
 * Internal Functions called by init functions.
 */

static krb5_error_code
krb5_ldap_bind(ldap_context, ldap_server_handle)
    krb5_ldap_context           *ldap_context;
    krb5_ldap_server_handle     *ldap_server_handle;
{
    krb5_error_code             st=0;
    struct berval               bv={0, NULL}, *servercreds=NULL;

    if (ldap_context->service_cert_path != NULL) {
	/* Certificate based bind (SASL EXTERNAL mechanism) */

	st = ldap_sasl_bind_s(ldap_server_handle->ldap_handle,
			      NULL,	   /* Authenticating dn */
			      LDAP_SASL_EXTERNAL,  /* Method used for authentication */
			      &bv,
			      NULL,
			      NULL,
			      &servercreds);

	while (st == LDAP_SASL_BIND_IN_PROGRESS) {
	    st = ldap_sasl_bind_s(ldap_server_handle->ldap_handle,
				  NULL,
				  LDAP_SASL_EXTERNAL,
				  servercreds,
				  NULL,
				  NULL,
				  &servercreds);
	}
    } else {
	/* password based simple bind */
        bv.bv_val = ldap_context->bind_pwd;
        bv.bv_len = strlen(ldap_context->bind_pwd);
        st = ldap_sasl_bind_s(ldap_server_handle->ldap_handle,
                                ldap_context->bind_dn,
                                LDAP_SASL_SIMPLE, &bv, NULL,
                                NULL, NULL);
    }
    return st;
}

static krb5_error_code
krb5_ldap_initialize(ldap_context, server_info)
    krb5_ldap_context *ldap_context;
    krb5_ldap_server_info *server_info;
{
    krb5_error_code             st=0;
    krb5_ldap_server_handle     *ldap_server_handle=NULL;
    char			*errstr = NULL;


    ldap_server_handle = calloc(1, sizeof(krb5_ldap_server_handle));
    if (ldap_server_handle == NULL) {
	st = ENOMEM;
	goto err_out;
    }
    else {
	/*
	 * Solaris Kerbreros: need ldap_handle to be NULL so calls to
	 * ldap_initialize won't leak handles
	 */
	ldap_server_handle->ldap_handle = NULL;
    }

    if (strncasecmp(server_info->server_name, "ldapi:", 6) == 0) {
	/*
	 * Solaris Kerberos: ldapi is not supported on Solaris at this time.
	 * return an error.
	 */
	if (ldap_context->kcontext)
	    krb5_set_error_message (ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR,
		gettext("ldapi is not supported"));
	st = KRB5_KDB_ACCESS_ERROR;
	goto err_out;
    } else {
	/*
	 * Solaris Kerbreros: need to use SSL to protect LDAP simple and
	 * External binds.
	 */
	if (ldap_context->root_certificate_file == NULL) {
	    if (ldap_context->kcontext)
		krb5_set_error_message (ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR,
		    gettext("ldap_cert_path not set, can not create SSL connection"));
	    st = KRB5_KDB_ACCESS_ERROR;
	    goto err_out;
	}

	/* setup for SSL */
	if ((st = ldapssl_client_init(ldap_context->root_certificate_file, NULL)) < 0) {
	    if (ldap_context->kcontext)
		krb5_set_error_message (ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR, "%s",
		    ldapssl_err2string(st));
	    st = KRB5_KDB_ACCESS_ERROR;
	    goto err_out;
	}

	/* ldap init, use SSL */
	if ((st = ldap_initialize(&ldap_server_handle->ldap_handle,
				    server_info->server_name, SSL_ON, &errstr)) != LDAP_SUCCESS) {
	    if (ldap_context->kcontext) {
		krb5_set_error_message (ldap_context->kcontext, KRB5_KDB_ACCESS_ERROR, "%s",
		    errstr);
	    }
	    st = KRB5_KDB_ACCESS_ERROR;
	    goto err_out;
	}

	if (ldap_context->service_cert_path != NULL) {
	    /*
	     * Solaris Kerbreros: for LDAP_SASL_EXTERNAL bind which requires the
	     * client offer its cert to the server.
	     */
	    if ((st = ldapssl_enable_clientauth(ldap_server_handle->ldap_handle,
					NULL, ldap_context->service_cert_pass,
					"XXX WAF need cert nickname/label")) < 0) {
		if (ldap_context->kcontext) {
		    krb5_set_error_message (ldap_context->kcontext,
					    KRB5_KDB_ACCESS_ERROR, "%s",
					    ldap_err2string(st));
		}
		st = KRB5_KDB_ACCESS_ERROR;
		goto err_out;
	    }
	}
    }

    if ((st=krb5_ldap_bind(ldap_context, ldap_server_handle)) == 0) {
	ldap_server_handle->server_info_update_pending = FALSE;
	server_info->server_status = ON;
	krb5_update_ldap_handle(ldap_server_handle, server_info);
    } else {
	if (ldap_context->kcontext)
	    /* Solaris Kerberos: Better error message */
	    krb5_set_error_message (ldap_context->kcontext,
				    KRB5_KDB_ACCESS_ERROR,
				    gettext("Failed to bind to ldap server \"%s\": %s"),
				    server_info->server_name, ldap_err2string(st));
	st = KRB5_KDB_ACCESS_ERROR;
	server_info->server_status = OFF;
	time(&server_info->downtime);
	(void)ldap_unbind_s(ldap_server_handle->ldap_handle);
	free(ldap_server_handle);
    }

err_out:
    return st;
}

/*
 * initialization for data base routines.
 */

krb5_error_code
krb5_ldap_db_init(krb5_context context, krb5_ldap_context *ldap_context)
{
    krb5_error_code             st=0;
    krb5_boolean                sasl_mech_supported=TRUE;
    int                         cnt=0, version=LDAP_VERSION3;
#ifdef LDAP_OPT_NETWORK_TIMEOUT
    struct timeval              local_timelimit = {10,0};
#elif defined LDAP_X_OPT_CONNECT_TIMEOUT
    int              		local_timelimit = 1000; /* Solaris Kerberos: 1 second */
#endif

    if ((st=krb5_validate_ldap_context(context, ldap_context)) != 0)
	goto err_out;

    ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &version);
#ifdef LDAP_OPT_NETWORK_TIMEOUT
    ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &local_timelimit);
#elif defined LDAP_X_OPT_CONNECT_TIMEOUT
    ldap_set_option(NULL, LDAP_X_OPT_CONNECT_TIMEOUT, &local_timelimit);
#endif

    HNDL_LOCK(ldap_context);
    while (ldap_context->server_info_list[cnt] != NULL) {
	krb5_ldap_server_info *server_info=NULL;

	server_info = ldap_context->server_info_list[cnt];

	if (server_info->server_status == NOTSET) {
	    int conns=0;

	    /*
	     * Check if the server has to perform certificate-based authentication
	     */
	    if (ldap_context->service_cert_path != NULL) {
		/* Find out if the server supports SASL EXTERNAL mechanism */
		if (has_sasl_external_mech(context, server_info->server_name) == 1) {
		    cnt++;
		    sasl_mech_supported = FALSE;
		    continue; /* Check the next LDAP server */
		}
		sasl_mech_supported = TRUE;
	    }

	    krb5_clear_error_message(context);

	    for (conns=0; conns < ldap_context->max_server_conns; ++conns) {
		if ((st=krb5_ldap_initialize(ldap_context, server_info)) != 0)
		    break;
	    } /* for (conn= ... */

	    if (server_info->server_status == ON)
		break;  /* server init successful, so break */
	}
	++cnt;
    }
    HNDL_UNLOCK(ldap_context);

err_out:
    if (sasl_mech_supported == FALSE) {
	st = KRB5_KDB_ACCESS_ERROR;
	krb5_set_error_message (context, st,
				gettext("Certificate based authentication requested but "
				"not supported by LDAP servers"));
    }
    return (st);
}


/*
 * get a single handle. Do not lock the mutex
 */

krb5_error_code
krb5_ldap_db_single_init(krb5_ldap_context *ldap_context)
{
    krb5_error_code             st=0;
    int                         cnt=0;
    krb5_ldap_server_info       *server_info=NULL;

    while (ldap_context->server_info_list[cnt] != NULL) {
	server_info = ldap_context->server_info_list[cnt];
	if ((server_info->server_status == NOTSET || server_info->server_status == ON)) {
	    if (server_info->num_conns < ldap_context->max_server_conns-1) {
		st = krb5_ldap_initialize(ldap_context, server_info);
		if (st == LDAP_SUCCESS)
		    goto cleanup;
	    }
	}
	++cnt;
    }

    /* If we are here, try to connect to all the servers */

    cnt = 0;
    while (ldap_context->server_info_list[cnt] != NULL) {
	server_info = ldap_context->server_info_list[cnt];
	st = krb5_ldap_initialize(ldap_context, server_info);
	if (st == LDAP_SUCCESS)
	    goto cleanup;
	++cnt;
    }
cleanup:
    return (st);
}

krb5_error_code
krb5_ldap_rebind(ldap_context, ldap_server_handle)
    krb5_ldap_context           *ldap_context;
    krb5_ldap_server_handle     **ldap_server_handle;
{
    krb5_ldap_server_handle     *handle = *ldap_server_handle;
    int				use_ssl;

    /*
     * Solaris Kerberos: use SSL unless ldapi (unix domain sockets is specified)
     */
    if (strncasecmp(handle->server_info->server_name, "ldapi:", 6) == 0)
	use_ssl = SSL_OFF;
    else
	use_ssl = SSL_ON;

    if ((ldap_initialize(&handle->ldap_handle, handle->server_info->server_name,
		use_ssl, NULL) != LDAP_SUCCESS)
	|| (krb5_ldap_bind(ldap_context, handle) != LDAP_SUCCESS))
	return krb5_ldap_request_next_handle_from_pool(ldap_context, ldap_server_handle);
    return LDAP_SUCCESS;
}

/*
 *     DAL API functions
 */
krb5_error_code krb5_ldap_lib_init()
{
    return 0;
}

krb5_error_code krb5_ldap_lib_cleanup()
{
    /* right now, no cleanup required */
    return 0;
}

krb5_error_code
krb5_ldap_free_ldap_context(krb5_ldap_context *ldap_context)
{
    if (ldap_context == NULL)
	return 0;

    krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
    ldap_context->krbcontainer = NULL;

    krb5_ldap_free_realm_params(ldap_context->lrparams);
    ldap_context->lrparams = NULL;

    krb5_ldap_free_server_params(ldap_context);

    return 0;
}

krb5_error_code
krb5_ldap_close(krb5_context context)
{
    kdb5_dal_handle  *dal_handle=NULL;
    krb5_ldap_context *ldap_context=NULL;

    if (context == NULL ||
	context->db_context == NULL ||
	((kdb5_dal_handle *)context->db_context)->db_context == NULL)
	return 0;

    dal_handle = (kdb5_dal_handle *) context->db_context;
    ldap_context = (krb5_ldap_context *) dal_handle->db_context;
    dal_handle->db_context = NULL;

    krb5_ldap_free_ldap_context(ldap_context);

    return 0;
}