/********************************************************************\

  Name:         auth.c
  Created by:   Stefan Ritt
  Copyright 2000 + Stefan Ritt

  ELOG is free software: you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation, either version 3 of the License, or
  (at your option) any later version.

  ELOG is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with ELOG.  If not, see <http://www.gnu.org/licenses/>.


  Contents:     Authentication subroutines. Currently supported:

                - password file authentication
                - kerberos5 password authentication

  $Id: elog.c 2350 2010-12-23 10:45:10Z ritt $

\********************************************************************/

#include "elogd.h"

#ifdef HAVE_KRB5
#include <krb5.h>
#endif

#ifdef HAVE_LDAP
#include <ldap.h>

LDAP *ldap_ld;
char ldap_login_attr[64];
char ldap_dn_user[256];
char ldap_pw_user[64];
char ldap_userbase[256];
char ldap_bindDN[512];
#endif  /* HAVE_LDAP */

extern LOGBOOK *lb_list;

/*==================================================================*/

/*---- Kerberos5 routines ------------------------------------------*/

#ifdef HAVE_KRB5

int auth_verify_password_krb5(LOGBOOK * lbs, const char *user, const char *password, char *error_str,
                              int error_size)
{
   char *princ_name, str[256], realm[256];
   krb5_error_code error;
   krb5_principal princ;
   krb5_context context;
   krb5_creds creds;
   krb5_get_init_creds_opt options;

   if (krb5_init_context(&context) < 0)
      return FALSE;

   strlcpy(str, user, sizeof(str));
   if (getcfg(lbs->name, "Kerberos Realm", realm, sizeof(realm))) {
      strlcat(str, "@", sizeof(str));
      strlcat(str, realm, sizeof(str));
   }
   if ((error = krb5_parse_name(context, str, &princ)) != 0) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   error = krb5_unparse_name(context, princ, &princ_name);
   if (error) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   sprintf(str, "Using %s as server principal for authentication", princ_name);
   write_logfile(lbs, str);

   memset(&options, 0, sizeof(options));
   krb5_get_init_creds_opt_init(&options);
   memset(&creds, 0, sizeof(creds));
   error = krb5_get_init_creds_password(context, &creds, princ,
                                        (char *) password, NULL, NULL, 0, NULL, &options);

   krb5_free_context(context);

   if (error && error != KRB5KDC_ERR_PREAUTH_FAILED && error != KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN) {
      sprintf(error_str, "<b>Kerberos error %d:</b>
", error);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   if (error)
      return FALSE;

   return TRUE;
}

int auth_change_password_krb5(LOGBOOK * lbs, const char *user, const char *old_pwd, const char *new_pwd,
                              char *error_str, int error_size)
{
   char *princ_name, str[256], realm[256];
   int result_code, n;
   krb5_error_code error;
   krb5_data result_code_string, result_string;
   krb5_principal princ;
   krb5_context context;
   krb5_creds creds;
   krb5_get_init_creds_opt options;

   if (krb5_init_context(&context) < 0)
      return FALSE;

   strlcpy(str, user, sizeof(str));
   if (getcfg(lbs->name, "Kerberos Realm", realm, sizeof(realm))) {
      strlcat(str, "@", sizeof(str));
      strlcat(str, realm, sizeof(str));
   }
   if ((error = krb5_parse_name(context, str, &princ)) != 0) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   error = krb5_unparse_name(context, princ, &princ_name);

   sprintf(str, "Using %s as server principal for authentication", princ_name);
   write_logfile(lbs, str);

   memset(&options, 0, sizeof(options));
   krb5_get_init_creds_opt_init(&options);
   krb5_get_init_creds_opt_set_tkt_life(&options, 300);
   krb5_get_init_creds_opt_set_forwardable(&options, FALSE);
   krb5_get_init_creds_opt_set_proxiable(&options, FALSE);

   memset(&creds, 0, sizeof(creds));
   error = krb5_get_init_creds_password(context, &creds, princ,
                                        (char *) old_pwd, NULL, NULL, 0, "kadmin/changepw", &options);
   if (error) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   error = krb5_set_password(context, &creds, (char *) new_pwd, princ,
                             &result_code, &result_code_string, &result_string);
   if (error) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   if (result_code > 0) {
      if (result_code_string.length > 0) {
         strlcpy(error_str, result_code_string.data, error_size);
         if ((int) result_code_string.length < error_size)
            error_str[result_code_string.length] = 0;
      }
      if (result_string.length > 0) {
         strlcat(error_str, ": ", error_size);
         n = strlen(error_str) + result_string.length;
         strlcat(error_str, result_string.data, error_size);
         if (n < error_size)
            error_str[n] = 0;
      }
   }

   krb5_free_data_contents(context, &result_code_string);
   krb5_free_data_contents(context, &result_string);
   krb5_free_cred_contents(context, &creds);
   krb5_get_init_creds_opt_free(context, &options);
   krb5_free_context(context);

   if (result_code > 0)
      return FALSE;

   return TRUE;
}
#endif

/*---- LDAP routines ------------------------------------------*/

#ifdef HAVE_LDAP

int ldap_init(LOGBOOK *lbs, char *error_str, int error_size)
{
   char str[512], ldap_server[256];
   int version;
   int bind=0;
   
   // Read Config file
   if (getcfg(lbs->name, "LDAP server", ldap_server, sizeof(ldap_server))) {
      strlcpy(str, ldap_server, sizeof(str));
   }
   else   {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, "ERR: Cannot find LDAP server entry!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   
   if (!getcfg(lbs->name, "LDAP userbase", ldap_userbase, sizeof(ldap_userbase))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP userbase (e.g. \'ou=People,dc=example,dc=org\')!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   
   if (!getcfg(lbs->name, "LDAP login attribute", ldap_login_attr, sizeof(ldap_login_attr))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP login attribute (e.g. uid, cn, ...)!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }

   if (!getcfg(lbs->name, "LDAP DN User", ldap_dn_user, sizeof(ldap_dn_user))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP login attribute (e.g. uid, cn, ...)!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   
   if (!getcfg(lbs->name, "LDAP PW User", ldap_pw_user, sizeof(ldap_pw_user))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP login attribute (e.g. uid, cn, ...)!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   // Initialize/open LDAP connection
   if(ldap_initialize( &ldap_ld, ldap_server )) {
      perror("ldap_initialize");
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      return FALSE;
   }

   // Use the LDAP_OPT_PROTOCOL_VERSION session preference to specify that the client is LDAPv3 client
   version = LDAP_VERSION3;
   ldap_set_option(ldap_ld, LDAP_OPT_PROTOCOL_VERSION, &version);
   
   write_logfile(lbs, str);
   
   return TRUE;
}

int auth_verify_password_ldap(LOGBOOK *lbs, const char *user, const char *password, char *error_str,
                              int error_size)
{  LDAPMessage *result, *err, *entry;
   int bind=0, i, rc=0, nb=0;
   char str[512], filter[512];
   char *attribute , *dn;
   BerElement *ber;
   BerValue **values;
    ldap_ld = NULL;
    memset(&ldap_bindDN[0], 0, sizeof(ldap_bindDN));
   struct timeval timeOut = {3,0}; // 3 second connection/search timeout
   // zerotime.tv_sec = zerotime.tv_usec = 0L;
   
   if(!ldap_init(lbs,error_str,error_size)) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      return FALSE;
   }
  
      printf("\n dn: %s\n", ldap_dn_user );
   //Bind with read account
   bind = ldap_simple_bind_s(ldap_ld, ldap_dn_user, ldap_pw_user, LDAP_AUTH_SIMPLE);
   if(bind != LDAP_SUCCESS) {
      strlcpy(error_str, "<b>LDAP BIND error with read account</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      return FALSE;
   }

   // search user
   sprintf(filter, "(%s=%s)", ldap_login_attr, user);

   rc = ldap_search_ext_s(
          ldap_ld,             // LDAP session handle
          ldap_userbase,       // Search Base

### Here be things to make the elogd daemon invisibly secure under an
### Apache SSL proxy virtual host.  Arrrrrr!
### ----This config file be mostly written by Jonathan Hanson, 11/23/04
### ----With some help from a few old salts on the net.



### This be the first instance of SSL in our setup, so the SSL module
### Must be called.  This can be commented out if it don't put wind in
### your sails.
LoadModule ssl_module modules/mod_ssl.so

### Ahoy, ye scurvy land dogs! Listen to the SSL port (443) or may the
### sea beasts take ye!
Listen 443

### Make a virtual host at the default server name, and assign it port 443.
<VirtualHost _default_:443>
	### Here be standard configuration for the Virtual Host
	ServerAdmin your_e-mail_address
	ServerName _default_:443
	RequestHeader set Front-End-Https "On"
	
	### This be the path to the elog directory 
	### (This didn't seem to make any difference, but it be a good
	###  idea nonetheless)
	DocumentRoot /usr/local/elog
	
	### Here be the setup for the SSL component of the Virtual Host
	SSLEngine On
	SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
	SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.pem
	
	### Here be the setup options for the Proxy module
	ProxyRequests Off
	ProxyPreserveHost On
	
	### This be the root of the new Virtual Host, and it should be
	### redirected to the port the elogd server is listening to 
	### (8079 on our poop deck).
	<Location />
		ProxyPass http://your.host.name:8079/
		ProxyPassReverse http://your.host.name:8079/
		SSLRequireSSL
	</Location>

	### Shiver me timbers!  A firewall can be laid across the elog
	### port to hinder direct access from the outside world to the elog
	### daemon.  This'll make the scurvy wretches come in through the apache
	### proxy virtual host, and batten down the hatches on the elog in general.

</VirtualHost>



### Our previous elog configuration was at http://your.host.name:8080 and some of our
### users made static HTML links to other posts in their posts and email.  They be sleeping 
### in Davy Jones's locker in the briney deep now, but we be needing to make these posts 
### backward-compatible.  We be changing the port Elogd listens to (as above) to 8079, and
### then we be using another new virtual host at port 8080 to redirect to the new SSL URL.
### So it appears to the landlubbers outside as if a normal elog server is listening to port
### 8080, but in reality it be a Virtual Host redirecting through the other SSL virtual host
### which then be passing it on to the port the elog server really be listening to.
### If ye not be needing this backwards compatability, the following section can be made
### to walk the plank.

### I won't be telling ye twice, ye slimy bilge rat!  Pay attention to what 
### used to be the old elog port(8080).
Listen 8080

<VirtualHost _default_:8080>
	### Here be standard configuration for the Virtual Host
	ServerAdmin your_e-mail_address
	ServerName _default_:8080
		
	### This be the path to the html directory 
	### (This didn't seem to make any difference, but it be a good
	###  idea nonetheless)
	DocumentRoot /httpd/html
	
	### Here be the dark magic of mod_rewrite.  Quake in your boots ye dogs!
	<IfModule mod_rewrite.c>
		RewriteEngine On
		RewriteRule ^/(.*) https://your.host.name/$1 [NC,R=301,L]
	</IfModule>
	
</VirtualHost>

### In the end, elog be reachable through either https://your.host.name/ 
### or http://your.host.name:8080/ , though the latter will be rewritten
### to the former as soon as the request be made.  This be satisfying our 
### needs for backwards compatbility with old URLs, while ensuring modern 
### secure SSL support.  Beware matey, recognize that we also had to change
### the port that elog listens to, and then add a URL line in the elogd.cfg
### file:
###      port = 8079
###      URL = https://your.host.name/
### Also a firewall was brought up and told to allow through only ports 
### 80(html), 443(SSL), and 8080(the elog stand-in) and of course any other 
### ports ye may need for other applications.

<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">

<!--
	Copyright (c) 2005-06-17 Peter Eriksson (peter@ifm.liu.se)

	This manifest can be used to manage an elog daemon using the 
	Solaris SMF subsystem.

	Import this manifest using: 

		svccfg -v import elog.xml
	
        Then activate the daemon with:

		svcadm enable site/elog
-->

<service_bundle type='manifest' name='IFM:elog'>

<service
	name='site/elog'
	type='service'
	version='1'>

        <single_instance />

	<!-- Need / & /usr filesystems mounted, /var mounted read/write -->
	<dependency
		name='fs-local'
		type='service'
		grouping='require_all'
		restart_on='none'>
		<service_fmri value='svc:/system/filesystem/local' />
	</dependency>

        <dependency
            name='network-service'
            grouping='require_all'
            restart_on='none'
            type='service'>
                <service_fmri value='svc:/network/service' />
        </dependency>

        <dependency
            name='name-services'
            grouping='require_all'
            restart_on='refresh'
            type='service'>
                <service_fmri value='svc:/milestone/name-services' />
        </dependency>
	
	<exec_method
		type='method'
		name='start'
		exec='/ifm/sbin/elogd -D -c /ifm/etc/elogd.cfg'
		timeout_seconds='60'>
	</exec_method>

	<exec_method
		type='method'
		name='stop'
		exec=':kill'
		timeout_seconds='30'>
	</exec_method>

	<instance name='default' enabled='false' />

	<stability value='Evolving' />

	<template>
		<common_name>
			<loctext xml:lang='C'>
			Electronic Logbook server
			</loctext>
		</common_name>
		<documentation>
			<manpage title='elogd' section='1' manpath='/usr/local/man' />
		</documentation>
	</template>
</service>

</service_bundle>

 setuid(2)							   setuid(2)




 NAME
      setuid(), setgid() - set user and group IDs

 SYNOPSIS
      #include <unistd.h>

      int setuid(uid_t uid);

      int setgid(gid_t gid);

 DESCRIPTION
      setuid() sets the real-user-ID (ruid), effective-user-ID (euid),
      and/or saved-user-ID (suid) of the calling process.  If the Security
      Containment product is installed, these interfaces treat a process
      observing CHSUBJIDENT as a privileged process.  Otherwise, only
      processes with an euid of zero are treated as privileged processes.
      See privileges(5) for more information on Security Containment and
      fine-grained privileges.

      The following conditions govern setuid's behavior:

	   +  If the process is privileged, setuid() sets the ruid, euid,
	      and suid to uid.

	   +  If the process is not privileged and the argument uid is equal
	      to the ruid or the suid, setuid() sets the euid to uid; the
	      ruid and suid remain unchanged.  (If a set-user-ID program is
	      not running as superuser, it can change its euid to match its
	      ruid and reset itself to the previous euid value.)

	   +  If the process is not privileged, the argument uid is equal to
	      the euid, and the calling process has the PRIV_SETRUGID
	      privilege, setuid() sets the ruid to uid; the euid and suid
	      remain unchanged.

      setgid() sets the real-group-ID (rgid), effective-group-ID (egid),
      and/or saved-group-ID (sgid) of the calling process.  The following
      conditions govern setgid()'s behavior:

	   +  If the process is privileged, setgid() sets the rgid and egid
	      to gid.

	   +  If the process is not privileged and the argument gid is equal
	      to the rgid or the sgid, setgid() sets the egid to gid; the
	      rgid and sgid remain unchanged.

	   +  If the process is not privileged, the argument gid is equal to
	      the egid, and the calling process has the PRIV_SETRUGID
	      privilege, setgid() sets the rgid to gid; the egid and sgid
	      remain unchanged.




 Hewlett-Packard Company	    - 1 -      HP-UX 11i Version 2: May 2006






 setuid(2)							   setuid(2)




    Security Restrictions
      Some or all of the actions associated with this system call require
      the CHSUBJIDENT privilege.  Processes owned by the superuser have this
      privilege.  Processes owned by other users may have this privilege,
      depending on system configuration.

      See privileges(5) for more information about privileged access on
      systems that support fine-grained privileges.

 RETURN VALUE
      Upon successful completion, setuid() and setgid() return 0; otherwise,
      they return -1 and set errno to indicate the error.

 ERRORS
      setuid() and setgid() fail and return -1 if any of the following
      conditions are encountered:

	   [EPERM]	  None of the conditions above are met.

	   [EINVAL]	  uid (gid) is not a valid user (group) ID.

 WARNINGS
      It is recommended that the PRIV_SETRUGID capability be avoided, as it
      is provided for backward compatibility.  This feature may be modified
      or dropped from future HP-UX releases.  When changing the real user ID
      and real group ID, use of setresuid() and setresgid() (see
      setresuid(2)) is recommended instead.

 AUTHOR
      setuid() was developed by AT&T, the University of California,
      Berkeley, and HP.

      setgid() was developed by AT&T.

 SEE ALSO
      exec(2), getuid(2), setresuid(2), privileges(5).

 STANDARDS CONFORMANCE
      setuid(): AES, SVID2, SVID3, XPG2, XPG3, XPG4, FIPS 151-2, POSIX.1

      setgid(): AES, SVID2, SVID3, XPG2, XPG3, XPG4, FIPS 151-2, POSIX.1













 Hewlett-Packard Company	    - 2 -      HP-UX 11i Version 2: May 2006

 setreuid(2)							 setreuid(2)




 NAME
      setreuid - set real and effective user IDs

 SYNOPSIS
      #include <unistd.h>

      int setreuid(uid_t ruid, uid_t euid);

 DESCRIPTION
      The setreuid() function sets the real and effective user IDs of the
      current process to the values specified by the ruid and euid
      arguments. If ruid or euid is -1, the corresponding effective or real
      user ID of the current process is left unchanged.

      A process with appropriate privileges can set either ID to any value.
      An unprivileged process can only set the effective user ID if the euid
      argument is equal to either the real, effective, or saved user ID of
      the process.

      It is unspecified whether a process without appropriate privileges is
      permitted to change the real user ID to match the current real,
      effective or saved user ID of the process.

 RETURN VALUE
      Upon successful completion, 0 is returned. Otherwise, -1 is returned
      and errno is set to indicate the error.

 ERRORS
      The setreuid() function will fail if:

	   [EINVAL]		    The value of the ruid or euid argument
				    is invalid or out-of-range.

	   [EPERM]		    The current process does not have
				    appropriate privileges, and either an
				    attempt was made to change the effective
				    user ID to a value other than the real
				    user ID or the saved set-user-ID or an
				    attempt was made to change the real user
				    ID to a value not permitted by the
				    implementation.

 SEE ALSO
      getuid(2), setuid(2), <unistd.h>.

 CHANGE HISTORY
      First released in Issue 4, Version 2.







 Hewlett-Packard Company	    - 1 -   HP-UX 11i Version 2: August 2003

 setresuid(2)							setresuid(2)




 NAME
      setresuid, setresgid - set real, effective, and saved user and group
      IDs

 SYNOPSIS
      #include <unistd.h>

      int setresuid(uid_t ruid, uid_t euid, uid_t suid);

      int setresgid(gid_t rgid, gid_t egid, gid_t sgid);

 DESCRIPTION
      setresuid() sets the real, effective and/or saved user ID of the
      calling process.

      If the current real, effective or saved user ID is equal to that of a
      user having appropriate privileges, setresuid() sets the real,
      effective and saved user IDs to ruid, euid, and suid, respectively.
      Otherwise, setresuid() only sets the real, effective, and saved user
      IDs if ruid, euid, and suid each match at least one of the current
      real, effective, or saved user IDs.

      If ruid, euid, or suid is -1, setresuid() leaves the current real,
      effective or saved user ID unchanged.

      setresgid() sets the real, effective and/or saved group ID of the
      calling process.

      If the current real, effective or saved user ID is equal to that of a
      user having appropriate privileges, setresgid() sets the real,
      effective, and saved group ID to rgid, egid, and sgid, respectively.
      Otherwise, setresgid() only sets the real, effective and saved group
      ID if rgid, egid, and sgid each match at least one of the current
      real, effective or saved group ID.

      If rgid, egid, or sgid is -1, setresgid() leaves the current real,
      effective or saved group ID unchanged.

    Security Restrictions
      Some or all of the actions associated with this system call require
      the PRIV_CHSUBJIDENT privilege (CHSUBJIDENT).  Processes owned by the
      superuser will have this privilege.  Processes owned by other users
      may have this privilege, depending on system configuration.  See
      privileges(5) for more information about privileged access on systems
      that support fine-grained privileges.

 RETURN VALUE
      Upon successful completion, setresuid() and setresgid() return 0;
      otherwise, they return -1 and set errno to indicate the error.





 Hewlett-Packard Company	    - 1 -      HP-UX 11i Version 2: May 2005






 setresuid(2)							setresuid(2)




 ERRORS
      setresuid() and setresgid() fail if any of the following conditions
      are encountered:

	   [EINVAL]	  ruid, euid, or suid (rgid, egid, or sgid) is not a
			  valid user (group) ID.

	   [EPERM]	  None of the conditions above are met.

 AUTHOR
      setresuid() and setresgid() were developed by HP.

 SEE ALSO
      exec(2), getuid(2), setuid(2).








































 Hewlett-Packard Company	    - 2 -      HP-UX 11i Version 2: May 2005