/*
 * Copyright 2016 Jeremy Allison
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */

/*
 * This is a regression test for a (former) problem in illumos
 * where a program that tries to send on a "connected" AF_UNIX
 * _datagram_ socket fails if: (a) the file system path used for
 * the socket requires privileges to access, and (b) a process
 * with privileges to access that path does a connect() to that
 * address and then drops privileges.  In that case, a sendmsg()
 * call where the "to" address is left blank should succeed.
 * Before the fix for illumos 7590 that would fail.
 *
 * This program must be run as root.  The expected output is:
 *
 *      non_priv_send - sendmsg fail (expected) Permission denied
 *      CLIENT:TEST0
 *      SERVER:TEST0
 *      CLIENT:TEST1
 *      SERVER:TEST1
 *      CLIENT:TEST2
 *      SERVER:TEST2
 *      CLIENT:TEST3
 *      SERVER:TEST3
 *      CLIENT:TEST4
 *      SERVER:TEST4
 *
 * Without the fix for 7590, one would see:
 *      non_priv_send - sendmsg fail (expected) Permission denied
 *      CLIENT:TEST0
 *      ./sendtest - sendmsg fail Permission denied
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <stdint.h>
#include <stdlib.h>

static int
server(struct sockaddr_un *addr)
{
        int ret;
        pid_t pid;
        int sock;
        unsigned int i;

        pid = fork();
        if (pid == (pid_t)-1) {
                fprintf(stderr, "server - fork fail %s\n", strerror(errno));
                return (-1);
        }

        if (pid != 0) {
                /* Parent. */
                return (0);
        }

        /* Child. */
        sock = socket(AF_UNIX, SOCK_DGRAM, 0);
        if (sock == -1) {
                fprintf(stderr, "server - socket fail %s\n", strerror(errno));
                exit(1);
        }

        ret = bind(sock, (struct sockaddr *)addr, sizeof (*addr));

        if (ret == -1) {
                fprintf(stderr, "server - bind fail %s\n", strerror(errno));
                exit(1);
        }

        for (i = 0; i < 5; i++) {
                struct iovec iov;
                struct msghdr msg;
                uint8_t buf[4096];

                iov = (struct iovec) {
                        .iov_base = buf,
                        .iov_len = sizeof (buf)
                };

                msg = (struct msghdr) {
                        .msg_iov = &iov,
                        .msg_iovlen = 1,
                };

                ret = recvmsg(sock, &msg, 0);
                if (ret == -1) {
                        fprintf(stderr, "server - recvmsg fail %s\n",
                            strerror(errno));
                        exit(1);
                }

                printf("SERVER:%s\n", (char *)msg.msg_iov->iov_base);
                fflush(stdout);
        }

        exit(0);
}

static void
non_priv_send(struct sockaddr_un *addr, int uid)
{
        pid_t pid;
        int sock;
        int ret;
        struct iovec iov;
        struct msghdr msg;
        uint8_t buf[4096];

        pid = fork();
        if (pid == (pid_t)-1) {
                fprintf(stderr, "non_priv_send - fork fail %s\n",
                    strerror(errno));
                return;
        }

        if (pid != 0) {
                /* Parent. */
                return;
        }

        /* Child. */
        memcpy(buf, "TEST1\n", sizeof ("TEST1\n"));

        iov = (struct iovec) {
                .iov_base = buf,
                .iov_len = sizeof (buf),
        };

        msg = (struct msghdr) {
                .msg_name = addr,
                .msg_namelen = sizeof (*addr),
                .msg_iov = &iov,
                .msg_iovlen = 1,
        };

        sock = socket(AF_UNIX, SOCK_DGRAM, 0);
        if (sock == -1) {
                fprintf(stderr, "non_priv_send - socket fail %s\n",
                    strerror(errno));
                exit(1);
        }

        ret = setreuid(uid, uid);
        if (ret == -1) {
                fprintf(stderr, "non_priv_send - setresuid fail %s\n",
                    strerror(errno));
                exit(1);
        }

        ret = sendmsg(sock, &msg, 0);

        if (ret == -1) {
                printf("non_priv_send - sendmsg fail (expected) %s\n",
                    strerror(errno));
                exit(0);
        }

        fprintf(stderr, "non_priv_send - UNEXPECTED sendmsg OK\n");
        exit(1);
}

/*
 * This should be a place only root is allowed to write.
 * The test will create and destroy this directory.
 */
char testdir[100] = "/var/run/os-tests-sockfs";
struct sockaddr_un addr;
int test_uid = UID_NOBODY;

int
main(int argc, char **argv)
{
        int ret;
        int sock;
        unsigned int i;
        uid_t us = geteuid();

        /* Ensure we're root. */
        if (us != 0) {
                fprintf(stderr, "%s: need to be root\n", argv[0]);
                exit(1);
        }

        if (argc > 1) {
                ret = strlcpy(testdir, argv[1], sizeof (testdir));
                if (ret >= sizeof (testdir)) {
                        fprintf(stderr, "%s: too long\n", argv[1]);
                        exit(1);
                }
        }

        addr.sun_family = AF_UNIX;
        (void) sprintf(addr.sun_path, "%s/s", testdir);

        if (mkdir(testdir, 0700) != 0) {
                switch (errno) {
                case EEXIST:
                case EISDIR:
                        break;
                default:
                        perror(testdir);
                        exit(1);
                }
        }
        (void) unlink(addr.sun_path);

        /* Set up the server. */
        ret = server(&addr);
        if (ret == -1) {
                fprintf(stderr, "%s - server fork fail %s\n",
                    argv[0], strerror(errno));
                exit(1);
        }

        sleep(1);

        /* Chec non-priv client - should fail. */
        non_priv_send(&addr, test_uid);

        sleep(1);

        /* Create and connect the socket endpoint. */

        sock = socket(AF_UNIX, SOCK_DGRAM, 0);
        if (sock == -1) {
                fprintf(stderr, "%s - socket fail %s\n",
                    argv[0], strerror(errno));
                exit(1);
        }

        ret = connect(sock, (struct sockaddr *)&addr, sizeof (addr));
        if (ret == -1) {
                fprintf(stderr, "%s - connect fail %s\n",
                    argv[0], strerror(errno));
                exit(1);
        }

        /*
         * Now lose all privilages.
         * The sendmsg() should still succeed as
         * 'sock' has been connected to the endpoint,
         * even though we don't have permissions as
         * the non privileged user to access the
         * UNIX domain socket.
         */

        ret = setreuid(test_uid, test_uid);
        if (ret == -1) {
                printf("%s - setresuid fail %s\n",
                    argv[0], strerror(errno));
                exit(1);
        }

        for (i = 0; i < 5; i++) {
                struct iovec iov;
                struct msghdr msg;
                uint8_t buf[4096];

                memcpy(buf, "TEST0", sizeof ("TEST0"));
                buf[4] = '0' + i;

                printf("CLIENT:%s\n", buf);

                iov = (struct iovec) {
                        .iov_base = buf,
                        .iov_len = sizeof (buf),
                };

                msg = (struct msghdr) {
                        /*
                         * If not for the dropped privileges that are
                         * the essential feature of this test, a more
                         * common practice would be to fill in the
                         * .msg_name, .msg_namelen fields here.
                         * However, when we've dropped privileges,
                         * and when we do specify the "to" address,
                         * the kernel does permission checks and the
                         * sendmsg fails with permission denied.
                         * So long as we do _not_ fill in the "to"
                         * address, send on a connected dgram socket
                         * is supposed to work.  Before the fix for
                         * illumos 7590, that would fail.
                         */
                        .msg_iov = &iov,
                        .msg_iovlen = 1,
                };

                ret = sendmsg(sock, &msg, 0);

                if (ret == -1) {
                        fprintf(stderr, "%s - sendmsg fail %s\n",
                            argv[0], strerror(errno));
                        exit(1);
                }

                fflush(stdout);
                sleep(1);
        }

        close(sock);
        return (0);
}