/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* plugins/preauth/spake/spake_client.c - SPAKE clpreauth module */
/*
 * Copyright (C) 2015 by the Massachusetts Institute of Technology.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * * Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 *
 * * Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in
 *   the documentation and/or other materials provided with the
 *   distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "k5-int.h"
#include "k5-spake.h"
#include "trace.h"
#include "util.h"
#include "iana.h"
#include "groups.h"
#include <krb5/clpreauth_plugin.h>

#include <openssl/crypto.h>

typedef struct reqstate_st {
    krb5_pa_spake *msg;         /* set in prep_questions, used in process */
    krb5_keyblock *initial_key;
    krb5_data *support;
    krb5_data thash;
    krb5_data spakeresult;
} reqstate;

/* Return true if SF-NONE is present in factors. */
static krb5_boolean
contains_sf_none(krb5_spake_factor **factors)
{
    int i;

    for (i = 0; factors != NULL && factors[i] != NULL; i++) {
        if (factors[i]->type == SPAKE_SF_NONE)
            return TRUE;
    }
    return FALSE;
}

static krb5_error_code
spake_init(krb5_context context, krb5_clpreauth_moddata *moddata_out)
{
    krb5_error_code ret;
    groupstate *gstate;

    ret = group_init_state(context, FALSE, &gstate);
    if (ret)
        return ret;
    *moddata_out = (krb5_clpreauth_moddata)gstate;
    return 0;
}

static void
spake_fini(krb5_context context, krb5_clpreauth_moddata moddata)
{
    group_free_state((groupstate *)moddata);
}

static void
spake_request_init(krb5_context context, krb5_clpreauth_moddata moddata,
                   krb5_clpreauth_modreq *modreq_out)
{
    *modreq_out = calloc(1, sizeof(reqstate));
}

static void
spake_request_fini(krb5_context context, krb5_clpreauth_moddata moddata,
                   krb5_clpreauth_modreq modreq)
{
    reqstate *st = (reqstate *)modreq;

    k5_free_pa_spake(context, st->msg);
    krb5_free_keyblock(context, st->initial_key);
    krb5_free_data(context, st->support);
    krb5_free_data_contents(context, &st->thash);
    zapfree(st->spakeresult.data, st->spakeresult.length);
    free(st);
}

static krb5_error_code
spake_prep_questions(krb5_context context, krb5_clpreauth_moddata moddata,
                     krb5_clpreauth_modreq modreq,
                     krb5_get_init_creds_opt *opt, krb5_clpreauth_callbacks cb,
                     krb5_clpreauth_rock rock, krb5_kdc_req *req,
                     krb5_data *enc_req, krb5_data *enc_prev_req,
                     krb5_pa_data *pa_data)
{
    krb5_error_code ret;
    groupstate *gstate = (groupstate *)moddata;
    reqstate *st = (reqstate *)modreq;
    krb5_data in_data;
    krb5_spake_challenge *ch;

    if (st == NULL)
        return ENOMEM;

    /* We don't need to ask any questions to send a support message. */
    if (pa_data->length == 0)
        return 0;

    /* Decode the incoming message, replacing any previous one in the request
     * state.  If we can't decode it, we have no questions to ask. */
    k5_free_pa_spake(context, st->msg);
    st->msg = NULL;
    in_data = make_data(pa_data->contents, pa_data->length);
    ret = decode_krb5_pa_spake(&in_data, &st->msg);
    if (ret)
        return (ret == ENOMEM) ? ENOMEM : 0;

    if (st->msg->choice == SPAKE_MSGTYPE_CHALLENGE) {
        ch = &st->msg->u.challenge;
        if (!group_is_permitted(gstate, ch->group))
            return 0;
        /* When second factor support is implemented, we should ask questions
         * based on the factors in the challenge. */
        if (!contains_sf_none(ch->factors))
            return 0;
        /* We will need the AS key to respond to the challenge. */
        cb->need_as_key(context, rock);
    } else if (st->msg->choice == SPAKE_MSGTYPE_ENCDATA) {
        /* When second factor support is implemented, we should decrypt the
         * encdata message and ask questions based on the factor data. */
    }
    return 0;
}

/*
 * Output a PA-SPAKE support message indicating which groups we support.  This
 * may be done for optimistic preauth, in response to an empty message, or in
 * response to a challenge using a group we do not support.  Save the support
 * message in st->support.
 */
static krb5_error_code
send_support(krb5_context context, groupstate *gstate, reqstate *st,
             krb5_pa_data ***pa_out)
{
    krb5_error_code ret;
    krb5_data *support;
    krb5_pa_spake msg;

    msg.choice = SPAKE_MSGTYPE_SUPPORT;
    group_get_permitted(gstate, &msg.u.support.groups, &msg.u.support.ngroups);
    ret = encode_krb5_pa_spake(&msg, &support);
    if (ret)
        return ret;

    /* Save the support message for later use in the transcript hash. */
    ret = krb5_copy_data(context, support, &st->support);
    if (ret) {
        krb5_free_data(context, support);
        return ret;
    }

    TRACE_SPAKE_SEND_SUPPORT(context);
    return convert_to_padata(support, pa_out);
}

static krb5_error_code
process_challenge(krb5_context context, groupstate *gstate, reqstate *st,
                  krb5_spake_challenge *ch, const krb5_data *der_msg,
                  krb5_clpreauth_callbacks cb, krb5_clpreauth_rock rock,
                  krb5_prompter_fct prompter, void *prompter_data,
                  const krb5_data *der_req, krb5_pa_data ***pa_out)
{
    krb5_error_code ret;
    krb5_keyblock *k0 = NULL, *k1 = NULL, *as_key;
    krb5_spake_factor factor;
    krb5_pa_spake msg;
    krb5_data *der_factor = NULL, *response;
    krb5_data clpriv = empty_data(), clpub = empty_data();
    krb5_data wbytes = empty_data();
    krb5_enc_data enc_factor;

    enc_factor.ciphertext = empty_data();

    /* Not expected if we processed a challenge and didn't reject it. */
    if (st->initial_key != NULL)
        return KRB5KDC_ERR_PREAUTH_FAILED;

    if (!group_is_permitted(gstate, ch->group)) {
        TRACE_SPAKE_REJECT_CHALLENGE(context, ch->group);
        /* No point in sending a second support message. */
        if (st->support != NULL)
            return KRB5KDC_ERR_PREAUTH_FAILED;
        return send_support(context, gstate, st, pa_out);
    }

    /* Initialize and update the transcript with the concatenation of the
     * support message (if we sent one) and the received challenge. */
    ret = update_thash(context, gstate, ch->group, &st->thash, st->support,
                       der_msg);
    if (ret)
        return ret;

    TRACE_SPAKE_RECEIVE_CHALLENGE(context, ch->group, &ch->pubkey);

    /* When second factor support is implemented, we should check for a
     * supported factor type instead of just checking for SF-NONE. */
    if (!contains_sf_none(ch->factors))
        return KRB5KDC_ERR_PREAUTH_FAILED;

    ret = cb->get_as_key(context, rock, &as_key);
    if (ret)
        goto cleanup;
    ret = krb5_copy_keyblock(context, as_key, &st->initial_key);
    if (ret)
        goto cleanup;
    ret = derive_wbytes(context, ch->group, st->initial_key, &wbytes);
    if (ret)
        goto cleanup;
    ret = group_keygen(context, gstate, ch->group, &wbytes, &clpriv, &clpub);
    if (ret)
        goto cleanup;
    ret = group_result(context, gstate, ch->group, &wbytes, &clpriv,
                       &ch->pubkey, &st->spakeresult);
    if (ret)
        goto cleanup;

    ret = update_thash(context, gstate, ch->group, &st->thash, &clpub, NULL);
    if (ret)
        goto cleanup;
    TRACE_SPAKE_CLIENT_THASH(context, &st->thash);

    /* Replace the reply key with K'[0]. */
    ret = derive_key(context, gstate, ch->group, st->initial_key, &wbytes,
                     &st->spakeresult, &st->thash, der_req, 0, &k0);
    if (ret)
        goto cleanup;
    ret = cb->set_as_key(context, rock, k0);
    if (ret)
        goto cleanup;

    /* Encrypt a SPAKESecondFactor message with K'[1]. */
    ret = derive_key(context, gstate, ch->group, st->initial_key, &wbytes,
                     &st->spakeresult, &st->thash, der_req, 1, &k1);
    if (ret)
        goto cleanup;
    /* When second factor support is implemented, we should construct an
     * appropriate factor here instead of hardcoding SF-NONE. */
    factor.type = SPAKE_SF_NONE;
    factor.data = NULL;
    ret = encode_krb5_spake_factor(&factor, &der_factor);
    if (ret)
        goto cleanup;
    ret = krb5_encrypt_helper(context, k1, KRB5_KEYUSAGE_SPAKE, der_factor,
                              &enc_factor);
    if (ret)
        goto cleanup;

    /* Encode and output a response message. */
    msg.choice = SPAKE_MSGTYPE_RESPONSE;
    msg.u.response.pubkey = clpub;
    msg.u.response.factor = enc_factor;
    ret = encode_krb5_pa_spake(&msg, &response);
    if (ret)
        goto cleanup;
    TRACE_SPAKE_SEND_RESPONSE(context);
    ret = convert_to_padata(response, pa_out);
    if (ret)
        goto cleanup;

    cb->disable_fallback(context, rock);

cleanup:
    krb5_free_keyblock(context, k0);
    krb5_free_keyblock(context, k1);
    krb5_free_data_contents(context, &enc_factor.ciphertext);
    krb5_free_data_contents(context, &clpub);
    zapfree(clpriv.data, clpriv.length);
    zapfree(wbytes.data, wbytes.length);
    if (der_factor != NULL) {
        zapfree(der_factor->data, der_factor->length);
        free(der_factor);
    }
    return ret;
}

static krb5_error_code
process_encdata(krb5_context context, reqstate *st, krb5_enc_data *enc,
                krb5_clpreauth_callbacks cb, krb5_clpreauth_rock rock,
                krb5_prompter_fct prompter, void *prompter_data,
                const krb5_data *der_prev_req, const krb5_data *der_req,
                krb5_pa_data ***pa_out)
{
    /* Not expected if we haven't sent a response yet. */
    if (st->initial_key == NULL || st->spakeresult.length == 0)
        return KRB5KDC_ERR_PREAUTH_FAILED;

    /*
     * When second factor support is implemented, we should process encdata
     * messages according to the factor type.  We should make sure to re-derive
     * K'[0] and replace the reply key again, in case the request has changed.
     * We should use der_prev_req to derive K'[n] to decrypt factor from the
     * KDC.  We should use der_req to derive K'[n+1] for the next message to
     * send to the KDC.
     */
    return KRB5_PLUGIN_OP_NOTSUPP;
}

static krb5_error_code
spake_process(krb5_context context, krb5_clpreauth_moddata moddata,
              krb5_clpreauth_modreq modreq, krb5_get_init_creds_opt *opt,
              krb5_clpreauth_callbacks cb, krb5_clpreauth_rock rock,
              krb5_kdc_req *req, krb5_data *der_req, krb5_data *der_prev_req,
              krb5_pa_data *pa_in, krb5_prompter_fct prompter,
              void *prompter_data, krb5_pa_data ***pa_out)
{
    krb5_error_code ret;
    groupstate *gstate = (groupstate *)moddata;
    reqstate *st = (reqstate *)modreq;
    krb5_data in_data;

    if (st == NULL)
        return ENOMEM;

    if (pa_in->length == 0) {
        /* Not expected if we already sent a support message. */
        if (st->support != NULL)
            return KRB5KDC_ERR_PREAUTH_FAILED;
        return send_support(context, gstate, st, pa_out);
    }

    if (st->msg == NULL) {
        /* The message failed to decode in spake_prep_questions(). */
        ret = KRB5KDC_ERR_PREAUTH_FAILED;
    } else if (st->msg->choice == SPAKE_MSGTYPE_CHALLENGE) {
        in_data = make_data(pa_in->contents, pa_in->length);
        ret = process_challenge(context, gstate, st, &st->msg->u.challenge,
                                &in_data, cb, rock, prompter, prompter_data,
                                der_req, pa_out);
    } else if (st->msg->choice == SPAKE_MSGTYPE_ENCDATA) {
        ret = process_encdata(context, st, &st->msg->u.encdata, cb, rock,
                              prompter, prompter_data, der_prev_req, der_req,
                              pa_out);
    } else {
        /* Unexpected message type */
        ret = KRB5KDC_ERR_PREAUTH_FAILED;
    }

    return ret;
}

krb5_error_code
clpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
                       krb5_plugin_vtable vtable);

krb5_error_code
clpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
                       krb5_plugin_vtable vtable)
{
    krb5_clpreauth_vtable vt;
    static krb5_preauthtype pa_types[] = { KRB5_PADATA_SPAKE, 0 };

    if (maj_ver != 1)
        return KRB5_PLUGIN_VER_NOTSUPP;

    if (FIPS_mode())
        return KRB5_CRYPTO_INTERNAL;

    vt = (krb5_clpreauth_vtable)vtable;
    vt->name = "spake";
    vt->pa_type_list = pa_types;
    vt->init = spake_init;
    vt->fini = spake_fini;
    vt->request_init = spake_request_init;
    vt->request_fini = spake_request_fini;
    vt->process = spake_process;
    vt->prep_questions = spake_prep_questions;
    return 0;
}