package plan9.auth;

//
// elements of Plan 9 authentication
//
// this is a near transliteration of Plan 9 source, subject to the Lucent Public License 1.02,
// via the Limbo P9auth module from Vita Nuova 2005
//

// Java version moved here from com.vitanuova.auth.P9auth
// revisions Copyright © 2012 Coraid Inc

// throws

import java.io.IOException;
import java.security.SecureRandom;
import java.security.spec.AlgorithmParameterSpec;

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

import java.nio.*;
import java.nio.channels.ByteChannel;
import java.nio.channels.ClosedByInterruptException;

import java.util.Arrays;

import plan9.lib.Misc;
import plan9.lib.Packer;
import plan9.lib.Strings;

public class P9auth {

	//
	// plan 9 authentication primitives
	//

	public static final int ANAMELEN = 	28; // maximum size of name in previous proto
	public static final int AERRLEN = 	64; // maximum size of errstr in previous proto
	public static final int DOMLEN = 	48; // length of an authentication domain name
	public static final int DESKEYLEN = 	7; // length of a des key for encrypt/decrypt
	public static final int CHALLEN = 	8; // length of a plan9 sk1 challenge
	public static final int NETCHLEN = 	16; // max network challenge length (used in AS protocol)
	public static final int SECRETLEN = 	32; // max length of a secret

	// encryption numberings (anti-replay)
	public static final int AuthTreq = 1; 	// ticket request
	public static final int AuthChal = 2; 	// challenge box request
	public static final int AuthPass = 3; 	// change password
	public static final int AuthOK = 4; 	// fixed length reply follows
	public static final int AuthErr = 5; 	// error follows
	public static final int AuthMod = 6; 	// modify user
	public static final int AuthApop = 7; 	// apop authentication for pop3
	public static final int AuthOKvar = 9; 	// variable length reply follows
	public static final int AuthChap = 10; 	// chap authentication for ppp
	public static final int AuthMSchap = 11; 	// MS chap authentication for ppp
	public static final int AuthCram = 12; 	// CRAM verification for IMAP (RFC2195 & rfc2104)
	public static final int AuthHttp = 13; 	// http domain login
	public static final int AuthVNC = 14; 	// VNC server login (deprecated)

	public static final int AuthTs = 64;	// ticket encrypted with server's key
	public static final int AuthTc = 65;	// ticket encrypted with client's key
	public static final int AuthAs = 66;	// server generated authenticator
	public static final int AuthAc = 67;	// client generated authenticator
	public static final int AuthTp = 68;	// ticket encrypted with client's key for password change
	public static final int AuthHr = 69;	// http reply

	public static final int TICKREQLEN = 3*ANAMELEN+CHALLEN+DOMLEN+1;

	public static class Ticketreq {
		public int rtype = 0;
		public String authid;		// [ANAMELEN]	server's encryption id
		public String authdom;	// [DOMLEN]	server's authentication domain
		public byte[] chal;	 	// [CHALLEN]	challenge from server
		public String hostid;		// [ANAMELEN]		host's encryption id
		public String uid;		// [ANAMELEN]	uid of requesting user on host

		public Ticketreq(){}

		public Ticketreq(int rtype, String authid, String authdom, byte[] chal, String hostid, String uid){
			this.rtype = rtype;
			this.authid = authid;
			this.authdom = authdom;
			this.chal = chal;
			this.hostid = hostid;
			this.uid = uid;
		}

		public int packedsize(){ return TICKREQLEN; }

		public final void pack(Packer b) {
			b.put1(rtype);
			b.puts(authid, ANAMELEN);
			b.puts(authdom, DOMLEN);
			b.puta(chal, CHALLEN);
			b.puts(hostid, ANAMELEN);
			b.puts(uid, ANAMELEN);
		}
		public Ticketreq unpack(Packer b) {
			rtype = b.get1();
			authid = b.gets(ANAMELEN);
			authdom = b.gets(DOMLEN);
			chal = b.geta(CHALLEN);
			hostid = b.gets(ANAMELEN);
			uid = b.gets(ANAMELEN);
			return this;
		}
	}

	public static final int TICKETLEN = CHALLEN+2*ANAMELEN+DESKEYLEN+1;
	public static class Ticket {
		public int num;	// replay protection
		public byte[] chal;	// [CHALLEN]	server challenge
		public String cuid;	// [ANAMELEN]	uid on client
		public String suid;	// [ANAMELEN]	uid on server
		public byte[] key;	// [DESKEYLEN]	nonce DES key

		public Ticket(){}

		public Ticket(int num, byte[] chal, String cuid, String suid, byte[] key){
			this.num = num;
			this.chal = chal;
			this.cuid = cuid;
			this.suid = suid;
			this.key = key;
		}

		public int packedsize() { return TICKETLEN; }
		
		public final void pack(Packer b, byte[] ckey) throws CryptoError {
			int o = b.offset();
			b.put1(num);
			b.puta(this.chal, CHALLEN);
			b.puts(cuid, ANAMELEN);
			b.puts(suid, ANAMELEN);
			b.puta(key, DESKEYLEN);
			if(ckey != null)
				encrypt(ckey, b.array(), o, TICKETLEN);
		}

		public Ticket unpack(Packer b, byte[] ckey) throws CryptoError {
			if(ckey != null)
				decrypt(ckey, b.array(), b.offset(), TICKETLEN);
			num = b.get1();
			chal = b.geta(CHALLEN);
			cuid = b.gets(ANAMELEN);
			suid = b.gets(ANAMELEN);
			key = b.geta(DESKEYLEN);
			return this;
		}
	}

	public static class TicketPair {
		public Ticket	known;	// was encrypted by Kc; unpacked
		public byte[]	hidden;	// encrypted by Ks, still packed

		public TicketPair(Ticket known, byte[] hidden){
			this.known = known;
			this.hidden = hidden;
		}
	}

	public static final int AUTHENTLEN = CHALLEN+4+1;
	public static class Authenticator {
		public int	num;		// replay protection
		public byte[]	chal;	// [CHALLEN]
		public int	id;		// authenticator id, ++'d with each auth

		public Authenticator(){}

		public Authenticator(int num, byte[] chal, int id){
			this.num = num;
			this.chal = chal;
			this.id = id;
		}

		public int packedsize(){ return AUTHENTLEN; }

		public final void pack(Packer b, byte[] key) throws CryptoError {
			int o = b.offset();
			b.put1(num);
			b.puta(chal, CHALLEN);
			b.put4(id);
			if(key != null)
				encrypt(key, b.array(), o, AUTHENTLEN);
		}

		public Authenticator unpack(Packer b, byte[] key) throws CryptoError {
			if(key != null)
				decrypt(key, b.array(), b.offset(), AUTHENTLEN);
			num = b.get1();
			chal = b.geta(CHALLEN);
			id = b.get4();
			return this;
		}
	}

	public static final int PASSREQLEN = 2*ANAMELEN+1+1+SECRETLEN;
	public static class Passwordreq {
		public int	num;
		public byte[]	oldpw;		// [ANAMELEN]
		public byte[]	newpw;		// [ANAMELEN]
		public boolean	changesecret;
		public byte[]	secret;	// [SECRETLEN]

		public Passwordreq(){}

		public Passwordreq(int num, byte[] oldpw, byte[] newpw, boolean changesecret, byte[] secret){
			this.num = num;
			this.oldpw = oldpw;
			this.newpw = newpw;
			this.changesecret = changesecret;
			this.secret = secret;
		}

		public int packedsize(){ return PASSREQLEN; }

		public final void pack(Packer b, byte[] key) throws CryptoError {
			b.put1(num);
			b.puta(oldpw, ANAMELEN);
			b.puta(newpw, ANAMELEN);
			b.put(changesecret? (byte)1: (byte)0);
			b.puta(secret, SECRETLEN);
			if(key != null)
				encrypt(key, b.array(), b.offset()-PASSREQLEN, PASSREQLEN);
		}

		public Passwordreq unpack(Packer b, byte[] key) throws CryptoError {
			if(key != null)
				decrypt(key, b.array(), b.offset(), PASSREQLEN);
			num = b.get1();
			oldpw = b.geta(ANAMELEN);
			oldpw[ANAMELEN-1] = (byte)0;
			newpw = b.geta(ANAMELEN);
			newpw[ANAMELEN-1] = (byte)0;
			changesecret = b.get() != (byte)0;
			secret = b.geta(SECRETLEN);
			secret[SECRETLEN-1] = (byte)0;
			return this;
		}
	}

	final static int UB(byte b){ return (int)b&0xFF; }

	/*
	 * SecureID and Plan 9 auth key/request/reply encryption (`netkey')
	 */
	public String netcrypt(byte[] key, String chal) throws CryptoError {
		byte[] buf = new byte[8];
		Arrays.fill(buf, (byte)0);
		byte[] a = Strings.bytes(chal);
		int l = a.length;
		if(l > DESKEYLEN)
			l = DESKEYLEN;
		System.arraycopy(a, 0, buf, 0, l);
		encrypt(key, buf, 0, buf.length);
		return String.format("%02x%02x%02x%02x", UB(buf[0]), UB(buf[1]), UB(buf[2]), UB(buf[3]));
	}

	public byte[] passtokey(String p) throws CryptoError {
		byte[] a = Strings.bytes(p);
		int n = a.length;
		if(n >= ANAMELEN)
			n = ANAMELEN-1;
		byte[] buf = new byte[ANAMELEN];
		Arrays.fill(buf, (byte)' ');
		System.arraycopy(a, 0, buf, 0, n);
		buf[n] = (byte)0;
		byte[] key = new byte[DESKEYLEN];
		Arrays.fill(key, (byte)0);
		int t = 0;
		for(;;){
			for(int i = 0; i < DESKEYLEN; i++)
				key[i] = (byte)((UB(buf[t+i]) >> i) + (UB(buf[t+i+1]) << (8 - (i+1))));
			if(n <= 8)
				return key;
			n -= 8;
			t += 8;
			if(n < 8){
				t -= 8 - n;
				n = 8;
			}
			encrypt(key, buf, t, 8);
		}
	}

	private static final short[] parity = {
		0x01, 0x02, 0x04, 0x07, 0x08, 0x0b, 0x0d, 0x0e, 
		0x10, 0x13, 0x15, 0x16, 0x19, 0x1a, 0x1c, 0x1f, 
		0x20, 0x23, 0x25, 0x26, 0x29, 0x2a, 0x2c, 0x2f, 
		0x31, 0x32, 0x34, 0x37, 0x38, 0x3b, 0x3d, 0x3e, 
		0x40, 0x43, 0x45, 0x46, 0x49, 0x4a, 0x4c, 0x4f, 
		0x51, 0x52, 0x54, 0x57, 0x58, 0x5b, 0x5d, 0x5e, 
		0x61, 0x62, 0x64, 0x67, 0x68, 0x6b, 0x6d, 0x6e, 
		0x70, 0x73, 0x75, 0x76, 0x79, 0x7a, 0x7c, 0x7f, 
		0x80, 0x83, 0x85, 0x86, 0x89, 0x8a, 0x8c, 0x8f, 
		0x91, 0x92, 0x94, 0x97, 0x98, 0x9b, 0x9d, 0x9e, 
		0xa1, 0xa2, 0xa4, 0xa7, 0xa8, 0xab, 0xad, 0xae, 
		0xb0, 0xb3, 0xb5, 0xb6, 0xb9, 0xba, 0xbc, 0xbf, 
		0xc1, 0xc2, 0xc4, 0xc7, 0xc8, 0xcb, 0xcd, 0xce, 
		0xd0, 0xd3, 0xd5, 0xd6, 0xd9, 0xda, 0xdc, 0xdf, 
		0xe0, 0xe3, 0xe5, 0xe6, 0xe9, 0xea, 0xec, 0xef, 
		0xf1, 0xf2, 0xf4, 0xf7, 0xf8, 0xfb, 0xfd, 0xfe,
	};

	public static final byte[] des56to64(byte[] k56){
		byte[] k64 = new byte[8];
		int hi = (UB(k56[0])<<24) | (UB(k56[1])<<16) | (UB(k56[2])<<8) | UB(k56[3]);
		int lo = (UB(k56[4])<<24) | (UB(k56[5])<<16) | (UB(k56[6])<<8);

		k64[0] = (byte)parity[(hi>>25)&0x7f];
		k64[1] = (byte)parity[(hi>>18)&0x7f];
		k64[2] = (byte)parity[(hi>>11)&0x7f];
		k64[3] = (byte)parity[(hi>>4)&0x7f];
		k64[4] = (byte)parity[((hi<<3)|(int)(lo>>>29))&0x7f];	// watch the sign extension
		k64[5] = (byte)parity[(lo>>22)&0x7f];
		k64[6] = (byte)parity[(lo>>15)&0x7f];
		k64[7] = (byte)parity[(lo>>8)&0x7f];
		return k64;
	}

	final static Cipher initdes(byte[] key, int mode) throws CryptoError {
		return Aids.initcipher("DES/ECB/NoPadding", des56to64(key), mode);
	}

	public final static void encrypt(byte[] key, byte[] data, int o, int n) throws CryptoError {
		int r, j;
		byte[] res;

		if(n < 8)
			throw new CryptoError("length less than block size");
		Cipher enc = initdes(key, Cipher.ENCRYPT_MODE);
		n--;
		r = n % 7;
		n /= 7;
		j = o;
		for(int i = 0; i < n; i++){
			res = enc.update(data, j, 8);
			System.arraycopy(res, 0, data, j, 8);
			j += 7;
		}
		if(r > 0){
			res = enc.update(data, j-7+r, 8);
			System.arraycopy(res, 0, data, j-7+r, 8);
		}
	}

	public final static void decrypt(byte[] key, byte[] data, int o, int n) throws CryptoError {
		int r, j;
		byte res[];

		if(n < 8)
			throw new CryptoError("length less than block size");
		Cipher dec = initdes(key, Cipher.DECRYPT_MODE);
		n--;
		r = n % 7;
		n /= 7;
		j = o + n*7;
		if(r > 0){
			res = dec.update(data, j-7+r, 8);
			System.arraycopy(res, 0, data, j-7+r, 8);
		}
		for(int i = 0; i < n; i++){
			j -= 7;
			res = dec.update(data, j, 8);
			System.arraycopy(res, 0, data, j, 8);
		}
	}

	private final static byte[] readn(ByteChannel fd, int nb) throws AuthProtoErr {
		try{
			return Misc.readn(fd, nb);
		}catch(ClosedByInterruptException e){
			throw new AuthProtoErr("interrupted by time-out", e);
		}catch(IOException e){
			throw new AuthProtoErr("read error: "+e.getMessage(), e);
		}
	}

	private final void write(ByteChannel fd, byte[] a) throws AuthProtoErr {
		try{
			fd.write(ByteBuffer.wrap(a));
		}catch(ClosedByInterruptException e){
			throw new AuthProtoErr("interrupted by time-out", e);
		}catch(IOException e){
			throw new AuthProtoErr("write error: "+e.getMessage(), e);
		}
	}

	private static final String pbmsg = "AS protocol botch";

	public final TicketPair _asgetticket(ByteChannel fd, Ticketreq tr, byte[] key) throws AuthProtoErr, LocalAuthErr, RemoteAuthErr {
		byte[] a = new byte[TICKREQLEN];
		tr.pack(new Packer(a));
		write(fd, a);
		a = _asrdresp(fd, 2*TICKETLEN);
		Packer p = new Packer(a);
		Ticket t;
		try{
			t = (new Ticket()).unpack(p, key);
		}catch(CryptoError e){
			throw new LocalAuthErr(e.getMessage(), e);
		}
		byte[] s = p.geta(TICKETLEN);
		return new TicketPair(t, s);
	}

	TicketPair mktickets(Ticketreq tr, byte[] key) throws CryptoError {
		Ticket tc, ts;
		byte[] randkey, a;

		if(!tr.authid.equals(tr.hostid))
			return null;

		randkey = new byte[DESKEYLEN];
		Aids.memrandom(randkey, 0, randkey.length);
		tc = new Ticket(AuthTc, tr.chal, tr.uid, tr.uid, randkey);
		ts = new Ticket(AuthTs, tr.chal, tr.uid, tr.uid, randkey);
		a = new byte[TICKETLEN];
		ts.pack(new Packer(a), key);
		return new TicketPair(tc, a);
	}

	public final byte[] _asrdresp(ByteChannel fd, int n) throws AuthProtoErr, RemoteAuthErr {
		byte[] b = readn(fd, 1);	// could convert to null return
		if(b == null)
			throw new AuthProtoErr("error reading from server");

		byte[] buf = null;
		switch((int)b[0]){
		case AuthOK:
			buf = readn(fd, n);
			break;
		case AuthOKvar:
			b = readn(fd, 5);
			if(b == null)
				break;
			n = Integer.parseInt(Strings.S(b));
			if(n<= 0 || n > 4096)
				break;
			buf = readn(fd, n);
			break;
		case AuthErr:
			b = readn(fd, 64);
			if(b == null)
				break;
			int i;
			for(i = 0; i<b.length && b[i] != (byte)0; i++)
				{}
			throw new RemoteAuthErr(String.format("remote: %s", Strings.S(b, 0, i)));
		default:
			throw new AuthProtoErr(String.format("%s: resp %d", pbmsg, (int)b[0]));
		}
		if(buf == null)
			throw new AuthProtoErr(pbmsg);
		return buf;
	}
}