/* -*- mode: C; c-file-style: "gnu" -*- */

/* dbus-keyring.c Store secret cookies in your homedir

 *

 * Copyright (C) 2003, 2004  Red Hat Inc.

 * Portion Copyright © 2008 Nokia Corporation and/or its subsidiary(-ies). All rights reserved.

 * Licensed under the Academic Free License version 2.1

 * 

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 * 

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 *

 */

#include "dbus-keyring.h"

#include "dbus-userdb.h"

#include "dbus-protocol.h"

#ifdef __SYMBIAN32__

// these are not system haerders

#include "dbus-string.h"

#include "dbus-list.h"

#include "dbus-sysdeps.h"

#include "libdbus_wsd_solution.h"

#else

#include <dbus/dbus-string.h>

#include <dbus/dbus-list.h>

#include <dbus/dbus-sysdeps.h>

#endif

/**

 * @defgroup DBusKeyring keyring class

 * @ingroup  DBusInternals

 * @brief DBusKeyring data structure

 *

 * Types and functions related to DBusKeyring. DBusKeyring is intended

 * to manage cookies used to authenticate clients to servers.  This is

 * essentially the "verify that client can read the user's homedir"

 * authentication mechanism.  Both client and server must have access

 * to the homedir.

 *

 * The secret keys are not kept in locked memory, and are written to a

 * file in the user's homedir. However they are transient (only used

 * by a single server instance for a fixed period of time, then

 * discarded). Also, the keys are not sent over the wire.

 *

 * @todo there's a memory leak on some codepath in here, I saw it once

 * when running make check - probably some specific initial cookies

 * present in the cookie file, then depending on what we do with them.

 */

/**

 * @defgroup DBusKeyringInternals DBusKeyring implementation details

 * @ingroup  DBusInternals

 * @brief DBusKeyring implementation details

 *

 * The guts of DBusKeyring.

 *

 * @{

 */

/** The maximum age of a key before we create a new key to use in

 * challenges.  This isn't super-reliably enforced, since system

 * clocks can change or be wrong, but we make a best effort to only

 * use keys for a short time.

 */

#define NEW_KEY_TIMEOUT_SECONDS     (60*5)

/**

 * The time after which we drop a key from the secrets file.

 * The EXPIRE_KEYS_TIMEOUT_SECONDS - NEW_KEY_TIMEOUT_SECONDS is the minimum

 * time window a client has to complete authentication.

 */

#define EXPIRE_KEYS_TIMEOUT_SECONDS (NEW_KEY_TIMEOUT_SECONDS + (60*2))

/**

 * The maximum amount of time a key can be in the future.

 */

#define MAX_TIME_TRAVEL_SECONDS (60*5)

/**

 * Maximum number of keys in the keyring before

 * we just ignore the rest

 */

#ifdef DBUS_BUILD_TESTS

#define MAX_KEYS_IN_FILE 10

#else

#define MAX_KEYS_IN_FILE 256

#endif

/**

 * A single key from the cookie file

 */

typedef struct

{

  dbus_int32_t id; /**< identifier used to refer to the key */

  long creation_time; /**< when the key was generated,

                       *   as unix timestamp. signed long

                       *   matches struct timeval.

                       */

  DBusString secret; /**< the actual key */

} DBusKey;

/**

 * @brief Internals of DBusKeyring.

 * 

 * DBusKeyring internals. DBusKeyring is an opaque object, it must be

 * used via accessor functions.

 */

struct DBusKeyring

{

  int refcount;             /**< Reference count */

  DBusString username;      /**< Username keyring is for */

  DBusString directory;     /**< Directory the below two items are inside */

  DBusString filename;      /**< Keyring filename */

  DBusString filename_lock; /**< Name of lockfile */

  DBusKey *keys; /**< Keys loaded from the file */

  int n_keys;    /**< Number of keys */

};

static DBusKeyring*

_dbus_keyring_new (void)

{

  DBusKeyring *keyring;

  keyring = dbus_new0 (DBusKeyring, 1);

  if (keyring == NULL)

    goto out_0;

  if (!_dbus_string_init (&keyring->directory))

    goto out_1;

  if (!_dbus_string_init (&keyring->filename))

    goto out_2;

  if (!_dbus_string_init (&keyring->filename_lock))

    goto out_3;

  if (!_dbus_string_init (&keyring->username))

    goto out_4;

  keyring->refcount = 1;

  keyring->keys = NULL;

  keyring->n_keys = 0;

  return keyring;

 out_4:

  _dbus_string_free (&keyring->filename_lock);

 out_3:

  _dbus_string_free (&keyring->filename);

 out_2:

  _dbus_string_free (&keyring->directory);

 out_1:

  dbus_free (keyring);

 out_0:

  return NULL;

}

static void

free_keys (DBusKey *keys,

           int      n_keys)

{

  int i;

  /* should be safe for args NULL, 0 */

  i = 0;

  while (i < n_keys)

    {

      _dbus_string_free (&keys[i].secret);

      ++i;

    }

  dbus_free (keys);

}

/* Our locking scheme is highly unreliable.  However, there is

 * unfortunately no reliable locking scheme in user home directories;

 * between bugs in Linux NFS, people using Tru64 or other total crap

 * NFS, AFS, random-file-system-of-the-week, and so forth, fcntl() in

 * homedirs simply generates tons of bug reports. This has been

 * learned through hard experience with GConf, unfortunately.

 *

 * This bad hack might work better for the kind of lock we have here,

 * which we don't expect to hold for any length of time.  Crashing

 * while we hold it should be unlikely, and timing out such that we

 * delete a stale lock should also be unlikely except when the

 * filesystem is running really slowly.  Stuff might break in corner

 * cases but as long as it's not a security-level breakage it should

 * be OK.

 */

/** Maximum number of timeouts waiting for lock before we decide it's stale */

#define MAX_LOCK_TIMEOUTS 32

/** Length of each timeout while waiting for a lock */

#define LOCK_TIMEOUT_MILLISECONDS 250

static dbus_bool_t

_dbus_keyring_lock (DBusKeyring *keyring)

{

  int n_timeouts;

  n_timeouts = 0;

  while (n_timeouts < MAX_LOCK_TIMEOUTS)

    {

      DBusError error;

      dbus_error_init (&error);

      if (_dbus_create_file_exclusively (&keyring->filename_lock,

                                         &error))

        break;

      _dbus_verbose ("Did not get lock file, sleeping %d milliseconds (%s)\n",

                     LOCK_TIMEOUT_MILLISECONDS, error.message);

      dbus_error_free (&error);

      _dbus_sleep_milliseconds (LOCK_TIMEOUT_MILLISECONDS);

      ++n_timeouts;

    }

  if (n_timeouts == MAX_LOCK_TIMEOUTS)

    {

      DBusError error;

      _dbus_verbose ("Lock file timed out %d times, assuming stale\n",

                     n_timeouts);

      dbus_error_init (&error);

      if (!_dbus_delete_file (&keyring->filename_lock, &error))

        {

          _dbus_verbose ("Couldn't delete old lock file: %s\n",

                         error.message);

          dbus_error_free (&error);

          return FALSE;

        }

      if (!_dbus_create_file_exclusively (&keyring->filename_lock,

                                          &error))

        {

          _dbus_verbose ("Couldn't create lock file after deleting stale one: %s\n",

                         error.message);

          dbus_error_free (&error);

          return FALSE;

        }

    }

  return TRUE;

}

static void

_dbus_keyring_unlock (DBusKeyring *keyring)

{

  DBusError error;

  dbus_error_init (&error);

  if (!_dbus_delete_file (&keyring->filename_lock, &error))

    {

      _dbus_warn ("Failed to delete lock file: %s\n",

                  error.message);

      dbus_error_free (&error);

    }

}

static DBusKey*

find_key_by_id (DBusKey *keys,

                int      n_keys,

                int      id)

{

  int i;

  i = 0;

  while (i < n_keys)

    {

      if (keys[i].id == id)

        return &keys[i];

      ++i;

    }

  return NULL;

}

static dbus_bool_t

add_new_key (DBusKey  **keys_p,

             int       *n_keys_p,

             DBusError *error)

{

#ifdef __SYMBIAN32__

// Cant use reserved word new in Symbian gcce

  DBusKey *new_key;

#else

  DBusKey *new;

#endif

  DBusString bytes;

  int id;

  long timestamp;

  const unsigned char *s;

  dbus_bool_t retval;

  DBusKey *keys;

  int n_keys;

  _DBUS_ASSERT_ERROR_IS_CLEAR (error);

  if (!_dbus_string_init (&bytes))

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      return FALSE;

    }

  keys = *keys_p;

  n_keys = *n_keys_p;

  retval = FALSE;

  /* Generate an integer ID and then the actual key. */

 retry:

  if (!_dbus_generate_random_bytes (&bytes, 4))

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      goto out;

    }

  s = (const unsigned char*) _dbus_string_get_const_data (&bytes);

  id = s[0] | (s[1] << 8) | (s[2] << 16) | (s[3] << 24);

  if (id < 0)

    id = - id;

  _dbus_assert (id >= 0);

  if (find_key_by_id (keys, n_keys, id) != NULL)

    {

      _dbus_string_set_length (&bytes, 0);

      _dbus_verbose ("Key ID %d already existed, trying another one\n",

                     id);

      goto retry;

    }

  _dbus_verbose ("Creating key with ID %d\n", id);

#define KEY_LENGTH_BYTES 24

  _dbus_string_set_length (&bytes, 0);

  if (!_dbus_generate_random_bytes (&bytes, KEY_LENGTH_BYTES))

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      goto out;

    }

#ifdef __SYMBIAN32__

  new_key = (DBusKey *) dbus_realloc (keys, sizeof (DBusKey) * (n_keys + 1));

  if (new_key == NULL)

#else

  new = dbus_realloc (keys, sizeof (DBusKey) * (n_keys + 1));

  if (new == NULL)

#endif

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      goto out;

    }

#ifdef __SYMBIAN32__

  keys = new_key;

#else

  keys = new;

#endif

  *keys_p = keys; /* otherwise *keys_p ends up invalid */

  n_keys += 1;

  if (!_dbus_string_init (&keys[n_keys-1].secret))

    {

      n_keys -= 1; /* we don't want to free the one we didn't init */

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      goto out;

    }

  _dbus_get_current_time (&timestamp, NULL);

  keys[n_keys-1].id = id;

  keys[n_keys-1].creation_time = timestamp;

  if (!_dbus_string_move (&bytes, 0,

                          &keys[n_keys-1].secret,

                          0))

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      _dbus_string_free (&keys[n_keys-1].secret);

      n_keys -= 1;

      goto out;

    }

  retval = TRUE;

 out:

  *n_keys_p = n_keys;

  _dbus_string_free (&bytes);

  return retval;

}

/**

 * Reloads the keyring file, optionally adds one new key to the file,

 * removes all expired keys from the file iff a key was added, then

 * resaves the file.  Stores the keys from the file in keyring->keys.

 * Note that the file is only resaved (written to) if a key is added,

 * this means that only servers ever write to the file and need to

 * lock it, which avoids a lot of lock contention at login time and

 * such.

 *

 * @param keyring the keyring

 * @param add_new #TRUE to add a new key to the file, expire keys, and resave

 * @param error return location for errors

 * @returns #FALSE on failure

 */

static dbus_bool_t

_dbus_keyring_reload (DBusKeyring *keyring,

                      dbus_bool_t  add_new,

                      DBusError   *error)

{

  DBusString contents;

  DBusString line;

  dbus_bool_t retval;

  dbus_bool_t have_lock;

  DBusKey *keys;

  int n_keys;

  int i;

  long now;

  DBusError tmp_error;

  _DBUS_ASSERT_ERROR_IS_CLEAR (error);

  if (!_dbus_check_dir_is_private_to_user (&keyring->directory, error))

    return FALSE;

  if (!_dbus_string_init (&contents))

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      return FALSE;

    }

  if (!_dbus_string_init (&line))

    {

      dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);

      _dbus_string_free (&contents);

      return FALSE;

    }

  keys = NULL;

  n_keys = 0;

  retval = FALSE;

  have_lock = FALSE;

  _dbus_get_current_time (&now, NULL);

  if (add_new)

    {

      if (!_dbus_keyring_lock (keyring))

        {

          dbus_set_error (error, DBUS_ERROR_FAILED,

                          "Could not lock keyring file to add to it");

          goto out;

        }

      have_lock = TRUE;

    }

  dbus_error_init (&tmp_error);

  if (!_dbus_file_get_contents (&contents, 

                                &keyring->filename,

                                &tmp_error))

    {

      _dbus_verbose ("Failed to load keyring file: %s\n",

                     tmp_error.message);

      /* continue with empty keyring file, so we recreate it */

      dbus_error_free (&tmp_error);

    }

  if (!_dbus_string_validate_ascii (&contents, 0,

                                    _dbus_string_get_length (&contents)))

    {

      _dbus_warn ("Secret keyring file contains non-ASCII! Ignoring existing contents\n");

      _dbus_string_set_length (&contents, 0);

    }

  /* FIXME this is badly inefficient for large keyring files

   * (not that large keyring files exist outside of test suites)

   */

  while (_dbus_string_pop_line (&contents, &line))

    {

      int next;

      long val;

      int id;

      long timestamp;

      int len;

      int end;

#ifdef __SYMBIAN32__

// Cannot use reserved word new in Symbian gcce

     DBusKey *new_key;

#else

      DBusKey *new;

#endif

      /* Don't load more than the max. */

      if (n_keys >= (add_new ? MAX_KEYS_IN_FILE - 1 : MAX_KEYS_IN_FILE))

        break;

      next = 0;

      if (!_dbus_string_parse_int (&line, 0, &val, &next))

        {

          _dbus_verbose ("could not parse secret key ID at start of line\n");

          continue;

        }

      if (val > _DBUS_INT32_MAX || val < 0)

        {

          _dbus_verbose ("invalid secret key ID at start of line\n");

          continue;

        }

      id = val;