/*

 * util.c Various utility functions.

 *

 * Version:     $Id: 32c720404e74d8c5f1beb14bd6ffaf0ca6c85120 $

 *

 *   This program is free software; you can redistribute it and/or modify

 *   it under the terms of the GNU General Public License as published by

 *   the Free Software Foundation; either version 2 of the License, or

 *   (at your option) any later version.

 *

 *   This program is distributed in the hope that it will be useful,

 *   but WITHOUT ANY WARRANTY; without even the implied warranty of

 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *   GNU General Public License for more details.

 *

 *   You should have received a copy of the GNU General Public License

 *   along with this program; if not, write to the Free Software

 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA

 *

 */

RCSID("$Id: 32c720404e74d8c5f1beb14bd6ffaf0ca6c85120 $")

#include <freeradius-devel/server/base.h>

#include <freeradius-devel/util/base16.h>

#include <freeradius-devel/util/skip.h>

#include <freeradius-devel/util/perm.h>

#include <freeradius-devel/util/cap.h>

#include <fcntl.h>

static bool suid_down_permanent = false;  //!< Record whether we've permanently dropped privilledges

/*

 *  The signal() function in Solaris 2.5.1 sets SA_NODEFER in

 *  sa_flags, which causes grief if signal() is called in the

 *  handler before the cause of the signal has been cleared.

 *  (Infinite recursion).

 *

 *  The same problem appears on HPUX, so we avoid it, if we can.

 *

 *  Using sigaction() to reset the signal handler fixes the problem,

 *  so where available, we prefer that solution.

 */

void (*reset_signal(int signo, void (*func)(int)))(int)

{

#ifdef HAVE_SIGACTION

  struct sigaction act, oact;

  memset(&act, 0, sizeof(act));

  act.sa_handler = func;

  sigemptyset(&act.sa_mask);

  act.sa_flags = 0;

#ifdef  SA_INTERRUPT    /* SunOS */

  act.sa_flags |= SA_INTERRUPT;

#endif

  if (sigaction(signo, &act, &oact) < 0)

    return SIG_ERR;

  return oact.sa_handler;

#else

  /*

   *  re-set by calling the 'signal' function, which

   *  may cause infinite recursion and core dumps due to

   *  stack growth.

   *

   *  However, the system is too dumb to implement sigaction(),

   *  so we don't have a choice.

   */

  signal(signo, func);

  return NULL;

#endif

}

/** Ensures that a filename cannot walk up the directory structure

 *

 * Also sanitizes control chars.

 *

 * @param out Output buffer.

 * @param in string to escape.

 * @param len Size of the output buffer.

 */

static ssize_t rad_filename_make_safe(char *out, char const *in, size_t len)

{

  char const *q, *end;

  char *p = out;

  q = in;

  end = in + len;

  /*

   *  Escape '.foo', as it could be used to either read the local directory, walk back up the

   *  directory hierarchy, or else to create "dot" files.

   */

  if (len > 1) {

    if (*q == '.') {

      *(p++) = '_';

      q++;

    }

  }

  while (q < end) {

    if (*q < ' ') {

      *(p++) = '_';

      q++;

      continue;

    }

    if (*q != '/') {

      *(p++) = *(q++);

      continue;

    }

    /*

     *  Mash slashes, too.

     */

    *(p++) = '_';

    q++;

    continue;

  }

  *p = '\0';

  return (p - out);

}

int rad_filename_box_make_safe(fr_value_box_t *vb, UNUSED void *uxtc)

{

  char      *escaped;

  size_t      len;

  if (vb->vb_length == 0) return 0;

  if (fr_value_box_is_safe_for(vb, rad_filename_box_make_safe)) return 1;

  /*

   *  Allocate an output buffer, only ever the same or shorter than the input

   */

  MEM(escaped = talloc_array(vb, char, vb->vb_length + 1));

  len = rad_filename_make_safe(escaped, vb->vb_strvalue, vb->vb_length);

  fr_value_box_strdup_shallow_replace(vb, escaped, len);

  fr_value_box_mark_safe_for(vb, rad_filename_box_make_safe);

  return 1;

}

/** Escapes the raw string such that it should be safe to use as part of a file path

 *

 * This function is designed to produce a string that's still readable but portable

 * across the majority of file systems.

 *

 * For security reasons it cannot remove characters from the name, and must not allow

 * collisions to occur between different strings.

 *

 * With that in mind '-' has been chosen as the escape character, and will be double

 * escaped '-' -> '--' to avoid collisions.

 *

 * Escaping should be reversible if the original string needs to be extracted.

 *

 * @note function takes additional arguments so that it may be used as an xlat escape

 *  function but it's fine to call it directly.

 *

 * @note OSX/Unix/NTFS/VFAT have a max filename size of 255 bytes.

 *

 * @param request Current request (may be NULL).

 * @param out Output buffer.

 * @param outlen Size of the output buffer.

 * @param in string to escape.

 * @param arg Context arguments (unused, should be NULL).

 */

ssize_t rad_filename_escape(UNUSED request_t *request, char *out, size_t outlen, char const *in, UNUSED void *arg)

{

  size_t freespace = outlen;

  while (*in != '\0') {

    size_t utf8_len;

    /*

     *  Encode multibyte UTF8 chars

     */

    utf8_len = fr_utf8_char((uint8_t const *) in, -1);

    if (utf8_len > 1) {

      if (freespace <= (utf8_len * 3)) break;

      switch (utf8_len) {

      case 2:

        snprintf(out, freespace, "-%02x-%02x", (uint8_t)in[0], (uint8_t)in[1]);

        break;

      case 3:

        snprintf(out, freespace, "-%02x-%02x-%02x", (uint8_t)in[0], (uint8_t)in[1], (uint8_t)in[2]);

        break;

      case 4:

        snprintf(out, freespace, "-%02x-%02x-%02x-%02x", (uint8_t)in[0], (uint8_t)in[1], (uint8_t)in[2], (uint8_t)in[3]);

        break;

      }

      freespace -= (utf8_len * 3);

      out += (utf8_len * 3);

      in += utf8_len;

      continue;

    }

    /*

     *  Safe chars

     */

    if (((*in >= 'A') && (*in <= 'Z')) ||

        ((*in >= 'a') && (*in <= 'z')) ||

        ((*in >= '0') && (*in <= '9')) ||

        (*in == '_')) {

          if (freespace <= 1) break;

      *out++ = *in++;

      freespace--;

      continue;

    }

    if (freespace <= 2) break;

    /*

     *  Double escape '-' (like \\)

     */

    if (*in == '-') {

      *out++ = '-';

      *out++ = '-';

      freespace -= 2;

      in++;

      continue;

    }

    /*

     *  Unsafe chars get escaped as -XX.

     */

    snprintf(out, freespace, "-%02x", (uint8_t) in[0]);

    in++;

    out += 3;

    freespace -= 3;

  }

  *out = '\0';

  return outlen - freespace;

}

int rad_filename_box_escape(fr_value_box_t *vb, UNUSED void *uxtc)

{

  char      *escaped;

  size_t      len;

  if (vb->vb_length == 0) return 0;

  fr_assert(!fr_value_box_is_safe_for(vb, rad_filename_box_escape));

  /*

   *  Allocate an output buffer, if every character is escaped,

   *  it will be 3 times the input

   */

  MEM(escaped = talloc_array(vb, char, vb->vb_length * 3 + 1));

  len = rad_filename_escape(NULL, escaped, (vb->vb_length * 3 + 1), vb->vb_strvalue, NULL);

  /*

   *  If the escaped length == input length, no changes were done.

   */

  if (len == vb->vb_length) {

    talloc_free(escaped);

    return 0;

  }

  fr_value_box_strdup_shallow_replace(vb, escaped, len);

  return 0;

}

/*

 *  Copy a quoted string.

 */

static int rad_copy_string(char *to, char const *from)

{

  int length = 0;

  char quote = *from;

  do {

    if (*from == '\\') {

      *(to++) = *(from++);

      length++;

    }

    *(to++) = *(from++);

    length++;

  } while (*from && (*from != quote));

  if (*from != quote) return -1; /* not properly quoted */

  *(to++) = quote;

  length++;

  *to = '\0';

  return length;

}

/*

 *  Copy a quoted string but without the quotes. The length

 *  returned is the number of chars written; the number of

 *  characters consumed is 2 more than this.

 */

static int rad_copy_string_bare(char *to, char const *from)

{

  int length = 0;

  char quote = *from;

  from++;

  while (*from && (*from != quote)) {

    if (*from == '\\') {

      *(to++) = *(from++);

      length++;

    }

    *(to++) = *(from++);

    length++;

  }

  if (*from != quote) return -1; /* not properly quoted */

  *to = '\0';

  return length;

}

/*

 *  Copy a %{} string.

 */

static int rad_copy_variable(char *to, char const *from)

{

  int length = 0;

  int sublen;

  *(to++) = *(from++);

  length++;

  while (*from) {

    switch (*from) {

    case '"':

    case '\'':

      sublen = rad_copy_string(to, from);

      if (sublen < 0) return sublen;

      from += sublen;

      to += sublen;

      length += sublen;

      break;

    case '}': /* end of variable expansion */

      *(to++) = *(from++);

      *to = '\0';

      length++;

      return length; /* proper end of variable */

    case '\\':

      *(to++) = *(from++);

      *(to++) = *(from++);

      length += 2;

      break;

    case '%': /* start of variable expansion */

      if (from[1] == '{') {

        *(to++) = *(from++);

        length++;

        sublen = rad_copy_variable(to, from);

        if (sublen < 0) return sublen;

        from += sublen;

        to += sublen;

        length += sublen;

        break;

      } /* else FIXME: catch %%{ ?*/

      FALL_THROUGH;

    default:

      *(to++) = *(from++);

      length++;

      break;

    }

  } /* loop over the input string */

  /*

   *  We ended the string before a trailing '}'

   */

  return -1;

}

uint32_t rad_pps(uint32_t *past, uint32_t *present, time_t *then, struct timeval *now)

{

  uint32_t pps;

  if (*then != now->tv_sec) {

    *then = now->tv_sec;

    *past = *present;

    *present = 0;

  }

  /*

   *  Bootstrap PPS by looking at a percentage of

   *  the previous PPS.  This lets us take a moving

   *  count, without doing a moving average.  If

   *  we're a fraction "f" (0..1) into the current

   *  second, we can get a good guess for PPS by

   *  doing:

   *

   *  PPS = pps_now + pps_old * (1 - f)

   *

   *  It's an instantaneous measurement, rather than

   *  a moving average.  This will hopefully let it

   *  respond better to sudden spikes.

   *

   *  Doing the calculations by thousands allows us

   *  to not overflow 2^32, AND to not underflow

   *  when we divide by USEC.

   */

  pps = USEC - now->tv_usec; /* useconds left in previous second */

  pps /= 1000;       /* scale to milliseconds */

  pps *= *past;      /* multiply by past count to get fraction */

  pps /= 1000;       /* scale to usec again */

  pps += *present;     /* add in current count */

  return pps;

}

/** Split string into words and expand each one

 *

 * @param request Current request.

 * @param cmd string to split.

 * @param max_argc the maximum number of arguments to split into.

 * @param argv Where to write the pointers into argv_buf.

 * @param can_fail If false, stop processing if any of the xlat expansions fail.

 * @param argv_buflen size of argv_buf.

 * @param argv_buf temporary buffer we used to mangle/expand cmd.

 *  Pointers to offsets of this buffer will be written to argv.

 * @return argc or -1 on failure.

 */

int rad_expand_xlat(request_t *request, char const *cmd,

        int max_argc, char const *argv[], bool can_fail,

        size_t argv_buflen, char *argv_buf)

{

  char const *from;

  char *to;

  int argc = -1;

  int i;

  int left;

  size_t len = strlen(cmd);

  if (len > (argv_buflen - 1)) {

    fr_strerror_const("Expansion string is too long for output buffer");

    return -1;

  }

  /*

   *  Check for bad escapes.

   */

  if ((len > 0) && (cmd[len - 1] == '\\')) {

    fr_strerror_const("Expansion string ends with a trailing backslash - invalid escape sequence");

    return -1;

  }

  strlcpy(argv_buf, cmd, argv_buflen);

  /*

   *  Split the string into argv's BEFORE doing xlat_eval...

   */

  from = cmd;

  to = argv_buf;

  argc = 0;

  while (*from) {

    int length;

    fr_skip_whitespace(from);

    argv[argc] = to;

    argc++;

    if (argc >= (max_argc - 1)) break;

    /*

     *  Copy the argv over to our buffer.

     */

    while (*from && (*from != ' ') && (*from != '\t')) {

      if (to >= argv_buf + argv_buflen - 1) {

        fr_strerror_const("Expansion string is too long for output buffer");

        return -1;

      }

      switch (*from) {

      case '"':

      case '\'':

        length = rad_copy_string_bare(to, from);

        if (length < 0) {

          fr_strerror_const("Invalid quoted string in expansion");

          return -1;

        }

        from += length+2;

        to += length;

        break;

      case '%':

        if (from[1] == '{') {

          *(to++) = *(from++);

          length = rad_copy_variable(to, from);

          if (length < 0) {

            fr_strerror_const("Invalid variable in expansion");

            return -1;

          }

          from += length;

          to += length;

        } else { /* FIXME: catch %%{ ? */

          *(to++) = *(from++);

        }

        break;

      case '\\':

        if (from[1] == ' ') from++;

        FALL_THROUGH;

      default:

        *(to++) = *(from++);

      }

    } /* end of string, or found a space */

    *(to++) = '\0'; /* terminate the string */

  }

  /*

   *  We have to have SOMETHING, at least.

   */

  if (argc <= 0) {

    fr_strerror_const("Expansion string is empty");

    return -1;

  }

  /*

   *  Expand each string, as appropriate.

   */

  left = argv_buf + argv_buflen - to;

  for (i = 0; i < argc; i++) {

    int sublen;

    /*

     *  Don't touch argv's which won't be translated.

     */

    if (strchr(argv[i], '%') == NULL) continue;

    if (!request) continue;

    sublen = xlat_eval(to, left - 1, request, argv[i], NULL, NULL);

    if (sublen <= 0) {

      if (can_fail) {

        /*

         *  Fail to be backwards compatible.

         *

         *  It's yucky, but it won't break anything,

         *  and it won't cause security problems.

         */

        sublen = 0;

      } else {

        fr_strerror_const("Failed expanding substring");

        return -1;

      }

    }

    argv[i] = to;

    to += sublen;

    *(to++) = '\0';

    left -= sublen;

    left--;

    if (left <= 0) {

      fr_strerror_const("Ran out of space while expanding arguments");

      return -1;

    }

  }

  argv[argc] = NULL;

  return argc;

}

#ifdef HAVE_SETUID

static bool doing_setuid = false;

static uid_t suid_down_uid = (uid_t)-1;

/** Set the uid and gid used when dropping privileges

 *

 * @note if this function hasn't been called, rad_suid_down will have no effect.

 *

 * @param uid to drop down to.

 */

void rad_suid_set_down_uid(uid_t uid)

{

  suid_down_uid = uid;

  doing_setuid = true;

}

#  if defined(HAVE_SETRESUID) && defined (HAVE_GETRESUID)

void rad_suid_up(void)

{

  uid_t ruid, euid, suid;

  if (getresuid(&ruid, &euid, &suid) < 0) {

    ERROR("Failed getting saved UID's");

    fr_exit_now(EXIT_FAILURE);

  }

  if (setresuid(-1, suid, -1) < 0) {

    ERROR("Failed switching to privileged user");

    fr_exit_now(EXIT_FAILURE);

  }

  if (geteuid() != suid) {

    ERROR("Switched to unknown UID");

    fr_exit_now(EXIT_FAILURE);

  }

}

void rad_suid_down(void)

{

  if (!doing_setuid) return;

  if (setresuid(-1, suid_down_uid, geteuid()) < 0) {

    struct passwd *passwd;

    char const *name;

    name = (fr_perm_getpwuid(NULL, &passwd, suid_down_uid) < 0) ? "unknown" : passwd->pw_name;

    ERROR("Failed switching to uid %s: %s", name, fr_syserror(errno));

    talloc_free(passwd);

    fr_exit_now(EXIT_FAILURE);

  }

  if (geteuid() != suid_down_uid) {

    ERROR("Failed switching uid: UID is incorrect");

    fr_exit_now(EXIT_FAILURE);

  }

  fr_reset_dumpable();

}

void rad_suid_down_permanent(void)

{

  if (!doing_setuid) return;

  if (setresuid(suid_down_uid, suid_down_uid, suid_down_uid) < 0) {

    struct passwd *passwd;

    char const *name;

    name = (fr_perm_getpwuid(NULL, &passwd, suid_down_uid) < 0) ? "unknown" : passwd->pw_name;

    ERROR("Failed in permanent switch to uid %s: %s", name, fr_syserror(errno));

    talloc_free(passwd);

    fr_exit_now(EXIT_FAILURE);

  }

  if (geteuid() != suid_down_uid) {

    ERROR("Switched to unknown uid");

    fr_exit_now(EXIT_FAILURE);

  }

  /*

   *  Shut down most of the interesting things which might get abused.

   */

  if ((fr_cap_disable(CAP_SETUID, CAP_EFFECTIVE) < 0) ||

      (fr_cap_disable(CAP_SETUID, CAP_INHERITABLE) < 0) ||

      (fr_cap_disable(CAP_SETUID, CAP_PERMITTED) < 0)) {

    ERROR("Failed disabling CAP_SUID");

    fr_exit_now(EXIT_FAILURE);

  }

#ifdef HAVE_GRP_H

  if ((fr_cap_disable(CAP_SETGID, CAP_EFFECTIVE) < 0) ||

      (fr_cap_disable(CAP_SETGID, CAP_INHERITABLE) < 0) ||

      (fr_cap_disable(CAP_SETGID, CAP_PERMITTED) < 0)) {

    ERROR("Failed disabling CAP_SGID");

    fr_exit_now(EXIT_FAILURE);

  }

#endif

  fr_reset_dumpable();

  suid_down_permanent = true;

}

#  else

/*

 *  Much less secure...

 */

void rad_suid_up(void)

{

  if (!doing_setuid) return;

  if (seteuid(0) < 0) {

    ERROR("Failed switching up to euid 0: %s", fr_syserror(errno));

    fr_exit_now(EXIT_FAILURE);

  }

}

void rad_suid_down(void)

{

  if (!doing_setuid) return;

  if (geteuid() == suid_down_uid) return;

  if (seteuid(suid_down_uid) < 0) {

    struct passwd *passwd;

    char const *name;

    name = (fr_perm_getpwuid(NULL, &passwd, suid_down_uid) < 0) ? "unknown": passwd->pw_name;

    ERROR("Failed switching to euid %s: %s", name, fr_syserror(errno));

    talloc_free(passwd);

    fr_exit_now(EXIT_FAILURE);

  }

  fr_reset_dumpable();

}

void rad_suid_down_permanent(void)

{

  if (!doing_setuid) return;

  /*

   *  Already done.  Don't do anything else.

   */

  if (getuid() == suid_down_uid) return;

  /*

   *  We're root, but running as a normal user.  Fix that,

   *  so we can call setuid().

   */

  if (geteuid() == suid_down_uid) {

    rad_suid_up();

  }

  if (setuid(suid_down_uid) < 0) {

    struct passwd *passwd;

    char const *name;

    name = (fr_perm_getpwuid(NULL, &passwd, suid_down_uid) < 0) ? "unknown": passwd->pw_name;

    ERROR("Failed switching permanently to uid %s: %s", name, fr_syserror(errno));

    talloc_free(passwd);

    fr_exit_now(EXIT_FAILURE);

  }

  fr_reset_dumpable();

  suid_down_permanent = true;

}

#  endif /* HAVE_SETRESUID && HAVE_GETRESUID */

#else  /* HAVE_SETUID */

void rad_suid_set_down_uid(uid_t uid)

{

}

void rad_suid_up(void)

{

}

void rad_suid_down(void)

{

  fr_reset_dumpable();

}

void rad_suid_down_permanent(void)

{

  fr_reset_dumpable();

}

#endif /* HAVE_SETUID */

/** Return whether we've permanently dropped root privileges

 *

 * @return

 *  - true if root privileges have been dropped.

 *  - false if root privileges have not been dropped.

 */

bool rad_suid_is_down_permanent(void)

{

  return suid_down_permanent;

}

/** Alter the effective user id

 *

 * @param uid to set

 * @return

 *  - 0 on success.

 *  - -1 on failure.

 */

int rad_seuid(uid_t uid)

{

  if (seteuid(uid) < 0) {

    int sete_errno = errno;  /* errno sets overwritten by fr_perm_getpwuid */

    struct passwd *passwd;

    if (fr_perm_getpwuid(NULL, &passwd, uid) < 0) return -1;

    fr_strerror_printf("%s", fr_syserror(sete_errno));

    talloc_free(passwd);

    return -1;

  }

  return 0;

}

/** Alter the effective user id

 *

 * @param gid to set

 * @return

 *  - 0 on success.

 *  - -1 on failure.

 */

int rad_segid(gid_t gid)

{

  if (setegid(gid) < 0) {

    int sete_errno = errno;  /* errno sets overwritten by fr_perm_getgrgid */

    struct group *group;

    if (fr_perm_getgrgid(NULL, &group, gid) < 0) return -1;

    fr_strerror_printf("%s", fr_syserror(sete_errno));

    talloc_free(group);

    return -1;

  }

  return 0;

}