/*
 * 4th Edition p9any/p9sk1 authentication based on auth9p1.c
 * Nigel Roles (nigel@9fs.org) 2003
 */

#include <plan9.h>
#include <fcall.h>
#include <u9fs.h>
#include <stdlib.h>	/* for random stuff */

typedef struct	Ticket		Ticket;
typedef struct	Ticketreq	Ticketreq;
typedef struct	Authenticator	Authenticator;

enum
{
	DOMLEN=		48,		/* length of an authentication domain name */
	CHALLEN=	8		/* length of a challenge */
};

enum {
	HaveProtos,
	NeedProto,
	NeedChal,
	HaveTreq,
	NeedTicket,
	HaveAuth,
	Established,
};

/* encryption numberings (anti-replay) */
enum
{
	AuthTreq=1,	/* ticket request */
	AuthChal=2,	/* challenge box request */
	AuthPass=3,	/* change password */
	AuthOK=4,	/* fixed length reply follows */
	AuthErr=5,	/* error follows */
	AuthMod=6,	/* modify user */
	AuthApop=7,	/* apop authentication for pop3 */
	AuthOKvar=9,	/* variable length reply follows */
	AuthChap=10,	/* chap authentication for ppp */
	AuthMSchap=11,	/* MS chap authentication for ppp */
	AuthCram=12,	/* CRAM verification for IMAP (RFC2195 & rfc2104) */
	AuthHttp=13,	/* http domain login */
	AuthVNC=14,	/* http domain login */


	AuthTs=64,	/* ticket encrypted with server's key */
	AuthTc,		/* ticket encrypted with client's key */
	AuthAs,		/* server generated authenticator */
	AuthAc,		/* client generated authenticator */
	AuthTp,		/* ticket encrypted with client's key for password change */
	AuthHr		/* http reply */
};

struct Ticketreq
{
	char	type;
	char	authid[NAMELEN];	/* server's encryption id */
	char	authdom[DOMLEN];	/* server's authentication domain */
	char	chal[CHALLEN];		/* challenge from server */
	char	hostid[NAMELEN];	/* host's encryption id */
	char	uid[NAMELEN];		/* uid of requesting user on host */
};
#define	TICKREQLEN	(3*NAMELEN+CHALLEN+DOMLEN+1)

struct Ticket
{
	char	num;			/* replay protection */
	char	chal[CHALLEN];		/* server challenge */
	char	cuid[NAMELEN];		/* uid on client */
	char	suid[NAMELEN];		/* uid on server */
	char	key[DESKEYLEN];		/* nonce DES key */
};
#define	TICKETLEN	(CHALLEN+2*NAMELEN+DESKEYLEN+1)

struct Authenticator
{
	char	num;			/* replay protection */
	char	chal[CHALLEN];
	ulong	id;			/* authenticator id, ++'d with each auth */
};
#define	AUTHENTLEN	(CHALLEN+4+1)

extern int chatty9p;

static	int	convT2M(Ticket*, char*, char*);
static	void	convM2T(char*, Ticket*, char*);
static	void	convM2Tnoenc(char*, Ticket*);
static	int	convA2M(Authenticator*, char*, char*);
static	void	convM2A(char*, Authenticator*, char*);
static	int	convTR2M(Ticketreq*, char*);
static	void	convM2TR(char*, Ticketreq*);
static	int	passtokey(char*, char*);

/*
 * destructively encrypt the buffer, which
 * must be at least 8 characters long.
 */
static int
encrypt9p(void *key, void *vbuf, int n)
{
	char ekey[128], *buf;
	int i, r;

	if(n < 8)
		return 0;
	key_setup(key, ekey);
	buf = vbuf;
	n--;
	r = n % 7;
	n /= 7;
	for(i = 0; i < n; i++){
		block_cipher(ekey, buf, 0);
		buf += 7;
	}
	if(r)
		block_cipher(ekey, buf - 7 + r, 0);
	return 1;
}

/*
 * destructively decrypt the buffer, which
 * must be at least 8 characters long.
 */
static int
decrypt9p(void *key, void *vbuf, int n)
{
	char ekey[128], *buf;
	int i, r;

	if(n < 8)
		return 0;
	key_setup(key, ekey);
	buf = vbuf;
	n--;
	r = n % 7;
	n /= 7;
	buf += n * 7;
	if(r)
		block_cipher(ekey, buf - 7 + r, 1);
	for(i = 0; i < n; i++){
		buf -= 7;
		block_cipher(ekey, buf, 1);
	}
	return 1;
}

#define	CHAR(x)		*p++ = f->x
#define	SHORT(x)	p[0] = f->x; p[1] = f->x>>8; p += 2
#define	VLONG(q)	p[0] = (q); p[1] = (q)>>8; p[2] = (q)>>16; p[3] = (q)>>24; p += 4
#define	LONG(x)		VLONG(f->x)
#define	STRING(x,n)	memmove(p, f->x, n); p += n

static int
convTR2M(Ticketreq *f, char *ap)
{
	int n;
	uchar *p;

	p = (uchar*)ap;
	CHAR(type);
	STRING(authid, NAMELEN);
	STRING(authdom, DOMLEN);
	STRING(chal, CHALLEN);
	STRING(hostid, NAMELEN);
	STRING(uid, NAMELEN);
	n = p - (uchar*)ap;
	return n;
}

static int
convT2M(Ticket *f, char *ap, char *key)
{
	int n;
	uchar *p;

	p = (uchar*)ap;
	CHAR(num);
	STRING(chal, CHALLEN);
	STRING(cuid, NAMELEN);
	STRING(suid, NAMELEN);
	STRING(key, DESKEYLEN);
	n = p - (uchar*)ap;
	if(key)
		encrypt9p(key, ap, n);
	return n;
}

int
convA2M(Authenticator *f, char *ap, char *key)
{
	int n;
	uchar *p;

	p = (uchar*)ap;
	CHAR(num);
	STRING(chal, CHALLEN);
	LONG(id);
	n = p - (uchar*)ap;
	if(key)
		encrypt9p(key, ap, n);
	return n;
}

#undef CHAR
#undef SHORT
#undef VLONG
#undef LONG
#undef STRING

#define	CHAR(x)		f->x = *p++
#define	SHORT(x)	f->x = (p[0] | (p[1]<<8)); p += 2
#define	VLONG(q)	q = (p[0] | (p[1]<<8) | (p[2]<<16) | (p[3]<<24)); p += 4
#define	LONG(x)		VLONG(f->x)
#define	STRING(x,n)	memmove(f->x, p, n); p += n

void
convM2A(char *ap, Authenticator *f, char *key)
{
	uchar *p;

	if(key)
		decrypt9p(key, ap, AUTHENTLEN);
	p = (uchar*)ap;
	CHAR(num);
	STRING(chal, CHALLEN);
	LONG(id);
	USED(p);
}

void
convM2T(char *ap, Ticket *f, char *key)
{
	uchar *p;

	if(key)
		decrypt9p(key, ap, TICKETLEN);
	p = (uchar*)ap;
	CHAR(num);
	STRING(chal, CHALLEN);
	STRING(cuid, NAMELEN);
	f->cuid[NAMELEN-1] = 0;
	STRING(suid, NAMELEN);
	f->suid[NAMELEN-1] = 0;
	STRING(key, DESKEYLEN);
	USED(p);
}

#undef CHAR
#undef SHORT
#undef LONG
#undef VLONG
#undef STRING

static int
passtokey(char *key, char *p)
{
	uchar buf[NAMELEN], *t;
	int i, n;

	n = strlen(p);
	if(n >= NAMELEN)
		n = NAMELEN-1;
	memset(buf, ' ', 8);
	t = buf;
	strncpy((char*)t, p, n);
	t[n] = 0;
	memset(key, 0, DESKEYLEN);
	for(;;){
		for(i = 0; i < DESKEYLEN; i++)
			key[i] = (t[i] >> i) + (t[i+1] << (8 - (i+1)));
		if(n <= 8)
			return 1;
		n -= 8;
		t += 8;
		if(n < 8){
			t -= 8 - n;
			n = 8;
		}
		encrypt9p(key, t, 8);
	}
	return 1;	/* not reached */
}

static char authkey[DESKEYLEN];
static char *authid;
static char *authdom;
static char *haveprotosmsg;
static char *needprotomsg;

static void
p9anyinit(void)
{
	int n, fd;
	char abuf[200];
	char *af, *f[4];

	af = autharg;
	if(af == nil)
		af = "/etc/u9fs.key";

	if((fd = open(af, OREAD)) < 0)
		sysfatal("can't open key file '%s'", af);

	if((n = readn(fd, abuf, sizeof(abuf)-1)) < 0)
		sysfatal("can't read key file '%s'", af);
	if (n > 0 && abuf[n - 1] == '\n')
		n--;
	abuf[n] = '\0';

	if(getfields(abuf, f, nelem(f), 0, "\n") != 3)
		sysfatal("key file '%s' not exactly 3 lines", af);

	passtokey(authkey, f[0]);
	authid = strdup(f[1]);
	authdom = strdup(f[2]);
	haveprotosmsg = malloc(strlen("p9sk1") + 1 + strlen(authdom) + 1);
	sprint(haveprotosmsg, "p9sk1@%s", authdom);
	needprotomsg = malloc(strlen("p9sk1") + 1 + strlen(authdom) + 1);
	sprint(needprotomsg, "p9sk1 %s", authdom);
}

typedef struct AuthSession {
	int state;
	char *uname;
	char *aname;
	char cchal[CHALLEN];
	Ticketreq tr;
	Ticket t;
} AuthSession;

static char*
p9anyauth(Fcall *rx, Fcall *tx)
{
	AuthSession *sp;
	Fid *f;
	char *ep;

	sp = malloc(sizeof(AuthSession));
	f = newauthfid(rx->afid, sp, &ep);
	if (f == nil) {
		free(sp);
		return ep;
	}
	if (chatty9p)
		fprint(2, "p9anyauth: afid %d\n", rx->afid);
	sp->state = HaveProtos;
	sp->uname = strdup(rx->uname);
	sp->aname = strdup(rx->aname);
	tx->aqid.type = QTAUTH;
	tx->aqid.path = 1;
	tx->aqid.vers = 0;
	return nil;
}

static char *
p9anyattach(Fcall *rx, Fcall *tx)
{
	AuthSession *sp;
	Fid *f;
	char *ep;

	f = oldauthfid(rx->afid, (void **)&sp, &ep);
	if (f == nil)
		return ep;
	if (chatty9p)
		fprint(2, "p9anyattach: afid %d state %d\n", rx->afid, sp->state);
	if (sp->state == Established && strcmp(rx->uname, sp->uname) == 0
		&& strcmp(rx->aname, sp->aname) == 0)
	{
		rx->uname = sp->t.suid;		/* will be valid until afid is clunked */
		return nil;
	}
	return "authentication failed";
}

static int
readstr(Fcall *rx, Fcall *tx, char *s, int len)
{
	if (rx->offset >= len)
		return 0;
	tx->count = len - rx->offset;
	if (tx->count > rx->count)
		tx->count = rx->count;
	memcpy(tx->data, s + rx->offset, tx->count);
	return tx->count;
}

static char *
p9anyread(Fcall *rx, Fcall *tx)
{
	AuthSession *sp;
	char *ep;

	Fid *f;
	f = oldauthfid(rx->afid, (void **)&sp, &ep);
	if (f == nil)
		return ep;
	if (chatty9p)
		fprint(2, "p9anyread: afid %d state %d\n", rx->fid, sp->state);
	switch (sp->state) {
	case HaveProtos:
		readstr(rx, tx, haveprotosmsg, strlen(haveprotosmsg) + 1);
		if (rx->offset + tx->count == strlen(haveprotosmsg) + 1)
			sp->state = NeedProto;
		return nil;
	case HaveTreq:
		if (rx->count != TICKREQLEN)
			goto botch;
		convTR2M(&sp->tr, tx->data);
		tx->count = TICKREQLEN;
		sp->state = NeedTicket;
		return nil;
	case HaveAuth: {
		Authenticator a;
		if (rx->count != AUTHENTLEN)
			goto botch;
		a.num = AuthAs;
		memmove(a.chal, sp->cchal, CHALLEN);
		a.id = 0;
		convA2M(&a, (char*)tx->data, sp->t.key);
		memset(sp->t.key, 0, sizeof(sp->t.key));
		tx->count = rx->count;
		sp->state = Established;
		return nil;
	}
	default:
	botch:
		return "protocol botch";
	}
}

static char *
p9anywrite(Fcall *rx, Fcall *tx)
{
	AuthSession *sp;
	char *ep;

	Fid *f;

	f = oldauthfid(rx->afid, (void **)&sp, &ep);
	if (f == nil)
		return ep;
	if (chatty9p)
		fprint(2, "p9anywrite: afid %d state %d\n", rx->fid, sp->state);
	switch (sp->state) {
	case NeedProto:
		if (rx->count != strlen(needprotomsg) + 1)
			return "protocol response wrong length";
		if (memcmp(rx->data, needprotomsg, rx->count) != 0)
			return "unacceptable protocol";
		sp->state = NeedChal;
		tx->count = rx->count;
		return nil;
	case NeedChal:
		if (rx->count != CHALLEN)
			goto botch;
		memmove(sp->cchal, rx->data, CHALLEN);
		sp->tr.type = AuthTreq;
		safecpy(sp->tr.authid, authid, sizeof(sp->tr.authid));
		safecpy(sp->tr.authdom, authdom, sizeof(sp->tr.authdom));
		randombytes((uchar *)sp->tr.chal, CHALLEN);
		safecpy(sp->tr.hostid, "", sizeof(sp->tr.hostid));
		safecpy(sp->tr.uid, "", sizeof(sp->tr.uid));
		tx->count = rx->count;
		sp->state = HaveTreq;
		return nil;
	case NeedTicket: {
		Authenticator a;

		if (rx->count != TICKETLEN + AUTHENTLEN) {
			fprint(2, "bad length in attach");
			goto botch;
		}
		convM2T((char*)rx->data, &sp->t, authkey);
		if (sp->t.num != AuthTs) {
			fprint(2, "bad AuthTs in attach\n");
			goto botch;
		}
		if (memcmp(sp->t.chal, sp->tr.chal, CHALLEN) != 0) {
			fprint(2, "bad challenge in attach\n");
			goto botch;
		}
		convM2A((char*)rx->data + TICKETLEN, &a, sp->t.key);
		if (a.num != AuthAc) {
			fprint(2, "bad AuthAs in attach\n");
			goto botch;
		}
		if(memcmp(a.chal, sp->tr.chal, CHALLEN) != 0) {
			fprint(2, "bad challenge in attach 2\n");
			goto botch;
		}
		sp->state = HaveAuth;
		tx->count = rx->count;
		return nil;
	}
	default:
	botch:
		return "protocol botch";
	}
}

static void
safefree(char *p)
{
	if (p) {
		memset(p, 0, strlen(p));
		free(p);
	}
}

static char *
p9anyclunk(Fcall *rx, Fcall *tx)
{
	Fid *f;
	AuthSession *sp;
	char *ep;

	f = oldauthfid(rx->afid, (void **)&sp, &ep);
	if (f == nil)
		return ep;
	if (chatty9p)
		fprint(2, "p9anyclunk: afid %d\n", rx->fid);
	safefree(sp->uname);
	safefree(sp->aname);
	memset(sp, 0, sizeof(sp));
	free(sp);
	return nil;
}

Auth authp9any = {
	"p9any",
	p9anyauth,
	p9anyattach,
	p9anyinit,
	p9anyread,
	p9anywrite,
	p9anyclunk,
};