/*      $NetBSD: server.c,v 1.12 2021/08/08 20:54:49 nia Exp $  */

/*-
 * Copyright (c) 2006 Itronix Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of Itronix Inc. may not be used to endorse
 *    or promote products derived from this software without specific
 *    prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */
/*-
 * Copyright (c) 2009 The NetBSD Foundation, Inc.
 * Copyright (c) 2004 Maksim Yevmenkin <m_evmenkin@yahoo.com>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: src/usr.sbin/bluetooth/sdpd/server.c,v 1.2 2005/12/06 17:56:36 emax Exp $
 */

#include <sys/cdefs.h>
__RCSID("$NetBSD: server.c,v 1.12 2021/08/08 20:54:49 nia Exp $");

#include <sys/select.h>
#include <sys/stat.h>
#include <sys/ucred.h>
#include <sys/un.h>

#include <assert.h>
#include <bluetooth.h>
#include <errno.h>
#include <grp.h>
#include <pwd.h>
#include <sdp.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "sdpd.h"

static bool     server_open_control     (server_t *, char const *);
static bool     server_open_l2cap       (server_t *);
static void     server_accept_client    (server_t *, int);
static bool     server_process_request  (server_t *, int);
static void     server_close_fd         (server_t *, int);
static bool     server_auth_check       (server_t *, void *);

/* number of groups we allocate space for in cmsg */
#define MAX_GROUPS      20

/*
 * Initialize server
 */
bool
server_init(server_t *srv, char const *control, char const *sgroup)
{

        assert(srv != NULL);
        assert(control != NULL);

        memset(srv, 0, sizeof(*srv));
        FD_ZERO(&srv->fdset);
        srv->sgroup = sgroup;

        srv->fdmax = -1;
        srv->fdidx = calloc(FD_SETSIZE, sizeof(fd_idx_t));
        if (srv->fdidx == NULL) {
                log_crit("Failed to allocate fd index");
                goto fail;
        }

        srv->ctllen = CMSG_SPACE(SOCKCREDSIZE(MAX_GROUPS));
        srv->ctlbuf = malloc(srv->ctllen);
        if (srv->ctlbuf == NULL) {
                log_crit("Malloc cmsg buffer (len=%zu) failed.", srv->ctllen);
                goto fail;
        }

        srv->imtu = SDP_LOCAL_MTU - sizeof(sdp_pdu_t);
        srv->ibuf = malloc(srv->imtu);
        if (srv->ibuf == NULL) {
                log_crit("Malloc input buffer (imtu=%d) failed.", srv->imtu);
                goto fail;
        }

        srv->omtu = L2CAP_MTU_DEFAULT - sizeof(sdp_pdu_t);
        srv->obuf = malloc(srv->omtu);
        if (srv->obuf == NULL) {
                log_crit("Malloc output buffer (omtu=%d) failed.", srv->omtu);
                goto fail;
        }

        if (db_init(srv)
            && server_open_control(srv, control)
            && server_open_l2cap(srv))
                return true;

fail:
        server_shutdown(srv);
        return false;
}

/*
 * Open local control socket
 */
static bool
server_open_control(server_t *srv, char const *control)
{
        struct sockaddr_un      un;
        int                     opt, fd;

        if (unlink(control) == -1 && errno != ENOENT) {
                log_crit("Could not unlink(%s). %s (%d)",
                    control, strerror(errno), errno);

                return false;
        }

        fd = socket(PF_LOCAL, SOCK_STREAM, 0);
        if (fd == -1) {
                log_crit("Could not create control socket. %s (%d)",
                    strerror(errno), errno);

                return false;
        }

        opt = 1;
        if (setsockopt(fd, SOL_LOCAL, LOCAL_CREDS, &opt, sizeof(opt)) == -1)
                log_crit("Warning: No credential checks on control socket");

        memset(&un, 0, sizeof(un));
        un.sun_len = sizeof(un);
        un.sun_family = AF_LOCAL;
        strlcpy(un.sun_path, control, sizeof(un.sun_path));

        if (bind(fd, (struct sockaddr *) &un, sizeof(un)) == -1) {
                log_crit("Could not bind control socket. %s (%d)",
                    strerror(errno), errno);

                close(fd);
                return false;
        }

        if (chmod(control, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH) == -1) {
                log_crit("Could not set permissions on control socket. %s (%d)",
                    strerror(errno), errno);

                close(fd);
                return false;
        }

        if (listen(fd, 5) == -1) {
                log_crit("Could not listen on control socket. %s (%d)",
                    strerror(errno), errno);

                close(fd);
                return false;
        }

        /* Add control descriptor to index */
        if (fd > srv->fdmax)
                srv->fdmax = fd;

        FD_SET(fd, &srv->fdset);
        srv->fdidx[fd].valid = true;
        srv->fdidx[fd].server = true;
        srv->fdidx[fd].control = true;
        srv->fdidx[fd].priv = false;
        return true;
}

/*
 * Open L2CAP server socket
 */
static bool
server_open_l2cap(server_t *srv)
{
        struct sockaddr_bt      sa;
        int                     fd;

        fd = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP);
        if (fd == -1) {
                log_crit("Could not create L2CAP socket. %s (%d)",
                    strerror(errno), errno);

                return false;
        }

        if (setsockopt(fd, BTPROTO_L2CAP, SO_L2CAP_IMTU,
            &srv->imtu, sizeof(srv->imtu)) == -1) {
                log_crit("Could not set L2CAP Incoming MTU. %s (%d)",
                    strerror(errno), errno);

                close(fd);
                return false;
        }

        memset(&sa, 0, sizeof(sa));
        sa.bt_len = sizeof(sa);
        sa.bt_family = AF_BLUETOOTH;
        sa.bt_psm = L2CAP_PSM_SDP;
        bdaddr_copy(&sa.bt_bdaddr, BDADDR_ANY);

        if (bind(fd, (struct sockaddr *) &sa, sizeof(sa)) == -1) {
                log_crit("Could not bind L2CAP socket. %s (%d)",
                    strerror(errno), errno);

                close(fd);
                return false;
        }

        if (listen(fd, 5) == -1) {
                log_crit("Could not listen on L2CAP socket. %s (%d)",
                    strerror(errno), errno);

                close(fd);
                return false;
        }

        /* Add L2CAP descriptor to index */
        if (fd > srv->fdmax)
                srv->fdmax = fd;

        FD_SET(fd, &srv->fdset);
        srv->fdidx[fd].valid = true;
        srv->fdidx[fd].server = true;
        srv->fdidx[fd].control = false;
        srv->fdidx[fd].priv = false;
        return true;
}

/*
 * Shutdown server
 */
void
server_shutdown(server_t *srv)
{
        record_t *r;
        int     fd;

        assert(srv != NULL);

        while ((r = LIST_FIRST(&srv->rlist)) != NULL) {
                LIST_REMOVE(r, next);
                free(r);
        }

        for (fd = 0; fd < srv->fdmax + 1; fd ++) {
                if (srv->fdidx[fd].valid)
                        server_close_fd(srv, fd);
        }

        free(srv->fdidx);
        free(srv->ctlbuf);
        free(srv->ibuf);
        free(srv->obuf);

        memset(srv, 0, sizeof(*srv));
}

/*
 * Do one server iteration
 */
bool
server_do(server_t *srv)
{
        fd_set  fdset;
        int     n, fd;

        assert(srv != NULL);

        memcpy(&fdset, &srv->fdset, sizeof(fdset));
        n = select(srv->fdmax + 1, &fdset, NULL, NULL, NULL);
        if (n == -1) {
                if (errno == EINTR)
                        return true;

                log_err("Could not select(%d, %p). %s (%d)",
                    srv->fdmax + 1, &fdset, strerror(errno), errno);

                return false;
        }

        for (fd = 0; fd < srv->fdmax + 1 && n > 0; fd++) {
                if (!FD_ISSET(fd, &fdset))
                        continue;

                assert(srv->fdidx[fd].valid);

                if (srv->fdidx[fd].server)
                        server_accept_client(srv, fd);
                else if (!server_process_request(srv, fd))
                        server_close_fd(srv, fd);

                n--;
        }

        return true;

}

/*
 * Accept new client connection and register it with index
 */
static void
server_accept_client(server_t *srv, int fd)
{
        struct sockaddr_bt      sa;
        socklen_t               len;
        int                     cfd;
        uint16_t                omtu;

        do {
                cfd = accept(fd, NULL, NULL);
        } while (cfd == -1 && errno == EINTR);

        if (cfd == -1) {
                log_err("Could not accept connection on %s socket. %s (%d)",
                    srv->fdidx[fd].control ? "control" : "L2CAP",
                    strerror(errno), errno);

                return;
        }

        if (cfd >= FD_SETSIZE) {
                log_crit("File descriptor too large");
                close(cfd);
                return;
        }

        assert(!FD_ISSET(cfd, &srv->fdset));
        assert(!srv->fdidx[cfd].valid);

        memset(&sa, 0, sizeof(sa));
        omtu = srv->omtu;

        if (!srv->fdidx[fd].control) {
                len = sizeof(sa);
                if (getsockname(cfd, (struct sockaddr *)&sa, &len) == -1)
                        log_warning("getsockname failed, using BDADDR_ANY");

                len = sizeof(omtu);
                if (getsockopt(cfd, BTPROTO_L2CAP, SO_L2CAP_OMTU, &omtu, &len) == -1)
                        log_warning("Could not get L2CAP OMTU, using %d", omtu);
                else
                        omtu -= sizeof(sdp_pdu_t);
        }

        /* Add client descriptor to the index */
        if (cfd > srv->fdmax)
                srv->fdmax = cfd;

        FD_SET(cfd, &srv->fdset);
        srv->fdidx[cfd].valid = true;
        srv->fdidx[cfd].server = false;
        srv->fdidx[cfd].control = srv->fdidx[fd].control;
        srv->fdidx[cfd].priv = false;
        srv->fdidx[cfd].omtu = (omtu > srv->omtu) ? srv->omtu : omtu;
        srv->fdidx[cfd].offset = 0;
        bdaddr_copy(&srv->fdidx[cfd].bdaddr, &sa.bt_bdaddr);

        log_debug("new %s client on fd#%d",
            srv->fdidx[cfd].control ? "control" : "L2CAP", cfd);
}

/*
 * Process request from the client
 */
static bool
server_process_request(server_t *srv, int fd)
{
        struct msghdr   msg;
        struct iovec    iov[2];
        struct cmsghdr  *cmsg;
        ssize_t         len;
        uint16_t        error;

        assert(FD_ISSET(fd, &srv->fdset));
        assert(srv->fdidx[fd].valid);
        assert(!srv->fdidx[fd].server);

        iov[0].iov_base = &srv->pdu;
        iov[0].iov_len = sizeof(srv->pdu);
        iov[1].iov_base = srv->ibuf;
        iov[1].iov_len = srv->imtu;

        msg.msg_name = NULL;
        msg.msg_namelen = 0;
        msg.msg_iov = iov;
        msg.msg_iovlen = __arraycount(iov);
        msg.msg_control = srv->ctlbuf;
        msg.msg_controllen = srv->ctllen;
        msg.msg_flags = 0;

        do {
                len = recvmsg(fd, &msg, 0);
        } while (len == -1 && errno == EINTR);

        if (len == -1) {
                log_err("Could not receive SDP request on %s socket. %s (%d)",
                    srv->fdidx[fd].control ? "control" : "L2CAP",
                    strerror(errno), errno);

                return false;
        }

        if (len == 0) {
                log_info("Client on %s socket has disconnected",
                    srv->fdidx[fd].control ? "control" : "L2CAP");

                return false;
        }

        if (msg.msg_flags & MSG_TRUNC)
                log_info("Truncated message on %s socket",
                    srv->fdidx[fd].control ? "control" : "L2CAP");

        if ((cmsg = CMSG_FIRSTHDR(&msg)) != NULL
            && cmsg->cmsg_level == SOL_SOCKET
            && cmsg->cmsg_type == SCM_CREDS
            && cmsg->cmsg_len >= CMSG_LEN(SOCKCREDSIZE(0)))
                srv->fdidx[fd].priv = server_auth_check(srv, CMSG_DATA(cmsg));

        srv->pdu.len = be16toh(srv->pdu.len);

        if ((uint32_t)len < sizeof(srv->pdu)
            || (uint32_t)len != sizeof(srv->pdu) + srv->pdu.len) {
                error = SDP_ERROR_CODE_INVALID_PDU_SIZE;
        } else {
                switch (srv->pdu.pid) {
                case SDP_PDU_SERVICE_SEARCH_REQUEST:
                        error = service_search_request(srv, fd);
                        break;

                case SDP_PDU_SERVICE_ATTRIBUTE_REQUEST:
                        error = service_attribute_request(srv, fd);
                        break;

                case SDP_PDU_SERVICE_SEARCH_ATTRIBUTE_REQUEST:
                        error = service_search_attribute_request(srv, fd);
                        break;

#ifdef SDP_COMPAT
                case SDP_PDU_SERVICE_REGISTER_REQUEST:
                        error = compat_register_request(srv, fd);
                        break;

                case SDP_PDU_SERVICE_CHANGE_REQUEST:
                        error = compat_change_request(srv, fd);
                        break;
#endif

                case SDP_PDU_RECORD_INSERT_REQUEST:
                        error = record_insert_request(srv, fd);
                        break;

                case SDP_PDU_RECORD_UPDATE_REQUEST:
                        error = record_update_request(srv, fd);
                        break;

                case SDP_PDU_RECORD_REMOVE_REQUEST:
                        error = record_remove_request(srv, fd);
                        break;

                default:
                        error = SDP_ERROR_CODE_INVALID_REQUEST_SYNTAX;
                        break;
                }
        }

        if (error != 0) {
                srv->fdidx[fd].offset = 0;
                db_unselect(srv, fd);
                srv->pdu.pid = SDP_PDU_ERROR_RESPONSE;
                srv->pdu.len = sizeof(error);
                be16enc(srv->obuf, error);
                log_debug("sending ErrorResponse (error=0x%04x)", error);
        }

        iov[0].iov_base = &srv->pdu;
        iov[0].iov_len = sizeof(srv->pdu);
        iov[1].iov_base = srv->obuf;
        iov[1].iov_len = srv->pdu.len;

        srv->pdu.len = htobe16(srv->pdu.len);

        msg.msg_name = NULL;
        msg.msg_namelen = 0;
        msg.msg_iov = iov;
        msg.msg_iovlen = __arraycount(iov);
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags = 0;

        do {
                len = sendmsg(fd, &msg, 0);
        } while (len == -1 && errno == EINTR);

        if (len == -1) {
                log_err("Could not send SDP response on %s socket. %s (%d)",
                    srv->fdidx[fd].control ? "control" : "L2CAP",
                    strerror(errno), errno);

                return false;
        }

        return true;
}

/*
 * Close descriptor and remove it from index
 */
static void
server_close_fd(server_t *srv, int fd)
{

        assert(FD_ISSET(fd, &srv->fdset));
        assert(srv->fdidx[fd].valid);

        db_unselect(srv, fd);   /* release selected records */
        db_release(srv, fd);    /* expire owned records */

        close(fd);
        FD_CLR(fd, &srv->fdset);
        srv->fdidx[fd].valid = false;

        log_debug("client on fd#%d closed", fd);

        if (fd == srv->fdmax) {
                while (fd > 0 && !srv->fdidx[fd].valid)
                        fd--;

                srv->fdmax = fd;
        }
}

/*
 * check credentials, return true when permitted to modify service records
 */
static bool
server_auth_check(server_t *srv, void *data)
{
        struct sockcred *cred = data;
        struct group *grp;
        int n;

        if (cred == NULL)
                return false;

        if (cred->sc_uid == 0 || cred->sc_euid == 0)
                return true;

        if (srv->sgroup == NULL)
                return false;

        grp = getgrnam(srv->sgroup);
        if (grp == NULL) {
                log_err("No gid for group '%s'", srv->sgroup);
                srv->sgroup = NULL;
                return false;
        }

        if (cred->sc_gid == grp->gr_gid || cred->sc_egid == grp->gr_gid)
                return true;

        if (cred->sc_ngroups > MAX_GROUPS) {
                log_info("Credentials truncated, lost %d groups",
                    MAX_GROUPS - cred->sc_ngroups);

                cred->sc_ngroups = MAX_GROUPS;
        }

        for (n = 0 ; n < cred->sc_ngroups ; n++) {
                if (cred->sc_groups[n] == grp->gr_gid)
                        return true;
        }

        return false;
}