/*-
 * Copyright (c) 2009-2020 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This material is based upon work partially supported by The
 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/cdefs.h>
__RCSID("$NetBSD: npf_cmd.c,v 1.1 2020/05/30 14:16:56 rmind Exp $");

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <err.h>

#ifdef __NetBSD__
#include <sha1.h>
#define SHA_DIGEST_LENGTH SHA1_DIGEST_LENGTH
#else
#include <openssl/sha.h>
#endif

#include "npfctl.h"

////////////////////////////////////////////////////////////////////////////
//
// NPFCTL RULE COMMANDS
//

#ifdef __NetBSD__
static unsigned char *
SHA1(const unsigned char *d, size_t l, unsigned char *md)
{
        SHA1_CTX c;

        SHA1Init(&c);
        SHA1Update(&c, d, l);
        SHA1Final(md, &c);
        return md;
}
#endif

static void
npfctl_generate_key(nl_rule_t *rl, void *key)
{
        void *meta;
        size_t len;

        if ((meta = npf_rule_export(rl, &len)) == NULL) {
                errx(EXIT_FAILURE, "error generating rule key");
        }
        __CTASSERT(NPF_RULE_MAXKEYLEN >= SHA_DIGEST_LENGTH);
        memset(key, 0, NPF_RULE_MAXKEYLEN);
        SHA1(meta, len, key);
        free(meta);
}

int
npfctl_nat_ruleset_p(const char *name, bool *natset)
{
        const size_t preflen = sizeof(NPF_RULESET_MAP_PREF) - 1;
        *natset = strncmp(name, NPF_RULESET_MAP_PREF, preflen) == 0;
        return (*natset && strlen(name) <= preflen) ? -1 : 0;
}

static nl_rule_t *
npfctl_parse_rule(int argc, char **argv, parse_entry_t entry)
{
        char rule_string[1024];
        nl_rule_t *rl;

        /* Get the rule string and parse it. */
        if (!join(rule_string, sizeof(rule_string), argc, argv, " ")) {
                errx(EXIT_FAILURE, "command too long");
        }
        npfctl_parse_string(rule_string, entry);
        if ((rl = npfctl_rule_ref()) == NULL) {
                errx(EXIT_FAILURE, "could not parse the rule");
        }
        return rl;
}

void
npfctl_rule(int fd, int argc, char **argv)
{
        static const struct ruleops_s {
                const char *    cmd;
                int             action;
                bool            extra_arg;
        } ruleops[] = {
                { "add",        NPF_CMD_RULE_ADD,       true    },
                { "rem",        NPF_CMD_RULE_REMKEY,    true    },
                { "del",        NPF_CMD_RULE_REMKEY,    true    },
                { "rem-id",     NPF_CMD_RULE_REMOVE,    true    },
                { "list",       NPF_CMD_RULE_LIST,      false   },
                { "flush",      NPF_CMD_RULE_FLUSH,     false   },
                { NULL,         0,                      0       }
        };
        uint8_t key[NPF_RULE_MAXKEYLEN];
        const char *ruleset_name = argv[0];
        const char *cmd = argv[1];
        int error, action = 0;
        bool extra_arg, natset;
        parse_entry_t entry;
        uint64_t rule_id;
        nl_rule_t *rl;

        for (unsigned n = 0; ruleops[n].cmd != NULL; n++) {
                if (strcmp(cmd, ruleops[n].cmd) == 0) {
                        action = ruleops[n].action;
                        extra_arg = ruleops[n].extra_arg;
                        break;
                }
        }
        argc -= 2;
        argv += 2;

        if (!action || (extra_arg && argc == 0)) {
                usage();
        }

        if (npfctl_nat_ruleset_p(ruleset_name, &natset) != 0) {
                errx(EXIT_FAILURE,
                    "invalid NAT ruleset name (note: the name must be "
                    "prefixed with `" NPF_RULESET_MAP_PREF "`)");
        }
        entry = natset ? NPFCTL_PARSE_MAP : NPFCTL_PARSE_RULE;

        switch (action) {
        case NPF_CMD_RULE_ADD:
                rl = npfctl_parse_rule(argc, argv, entry);
                npfctl_generate_key(rl, key);
                npf_rule_setkey(rl, key, sizeof(key));
                error = npf_ruleset_add(fd, ruleset_name, rl, &rule_id);
                break;
        case NPF_CMD_RULE_REMKEY:
                rl = npfctl_parse_rule(argc, argv, entry);
                npfctl_generate_key(rl, key);
                error = npf_ruleset_remkey(fd, ruleset_name, key, sizeof(key));
                break;
        case NPF_CMD_RULE_REMOVE:
                rule_id = strtoull(argv[0], NULL, 16);
                error = npf_ruleset_remove(fd, ruleset_name, rule_id);
                break;
        case NPF_CMD_RULE_LIST:
                error = npfctl_ruleset_show(fd, ruleset_name);
                break;
        case NPF_CMD_RULE_FLUSH:
                error = npf_ruleset_flush(fd, ruleset_name);
                break;
        default:
                abort();
        }

        switch (error) {
        case 0:
                /* Success. */
                break;
        case ESRCH:
                errx(EXIT_FAILURE, "ruleset \"%s\" not found", ruleset_name);
        case ENOENT:
                errx(EXIT_FAILURE, "rule was not found");
        default:
                errx(EXIT_FAILURE, "rule operation: %s", strerror(error));
        }
        if (action == NPF_CMD_RULE_ADD) {
                printf("OK %" PRIx64 "\n", rule_id);
        }
}

////////////////////////////////////////////////////////////////////////////
//
// NPFCTL TABLE COMMANDS
//

static int
npfctl_table_type(const char *typename)
{
        static const struct tbltype_s {
                const char *    name;
                unsigned        type;
        } tbltypes[] = {
                { "ipset",      NPF_TABLE_IPSET },
                { "lpm",        NPF_TABLE_LPM   },
                { "const",      NPF_TABLE_CONST },
                { NULL,         0               }
        };

        for (unsigned i = 0; tbltypes[i].name != NULL; i++) {
                if (strcmp(typename, tbltypes[i].name) == 0) {
                        return tbltypes[i].type;
                }
        }
        return 0;
}

void
npfctl_table_replace(int fd, int argc, char **argv)
{
        const char *name, *newname, *path, *typename = NULL;
        nl_config_t *ncf;
        nl_table_t *t;
        unsigned type = 0;
        int c, tid = -1;
        FILE *fp;

        name = newname = argv[0];
        optind = 2;
        while ((c = getopt(argc, argv, "n:t:")) != -1) {
                switch (c) {
                case 't':
                        typename = optarg;
                        break;
                case 'n':
                        newname = optarg;
                        break;
                default:
                        errx(EXIT_FAILURE,
                            "Usage: %s table \"table-name\" replace "
                            "[-n \"name\"] [-t <type>] <table-file>\n",
                            getprogname());
                }
        }
        argc -= optind;
        argv += optind;

        if (typename && (type = npfctl_table_type(typename)) == 0) {
                errx(EXIT_FAILURE, "unsupported table type '%s'", typename);
        }

        if (argc != 1) {
                usage();
        }

        path = argv[0];
        if (strcmp(path, "-") == 0) {
                path = "stdin";
                fp = stdin;
        } else if ((fp = fopen(path, "r")) == NULL) {
                err(EXIT_FAILURE, "open '%s'", path);
        }

        /* Get existing config to lookup ID of existing table */
        if ((ncf = npf_config_retrieve(fd)) == NULL) {
                err(EXIT_FAILURE, "npf_config_retrieve()");
        }
        if ((t = npfctl_table_getbyname(ncf, name)) == NULL) {
                errx(EXIT_FAILURE,
                    "table '%s' not found in the active configuration", name);
        }
        tid = npf_table_getid(t);
        if (!type) {
                type = npf_table_gettype(t);
        }
        npf_config_destroy(ncf);

        if ((t = npfctl_load_table(newname, tid, type, path, fp)) == NULL) {
                err(EXIT_FAILURE, "table load failed");
        }

        if (npf_table_replace(fd, t, NULL)) {
                err(EXIT_FAILURE, "npf_table_replace(<%s>)", name);
        }
}

void
npfctl_table(int fd, int argc, char **argv)
{
        static const struct tblops_s {
                const char *    cmd;
                int             action;
        } tblops[] = {
                { "add",        NPF_CMD_TABLE_ADD               },
                { "rem",        NPF_CMD_TABLE_REMOVE            },
                { "del",        NPF_CMD_TABLE_REMOVE            },
                { "test",       NPF_CMD_TABLE_LOOKUP            },
                { "list",       NPF_CMD_TABLE_LIST              },
                { "flush",      NPF_CMD_TABLE_FLUSH             },
                { NULL,         0                               }
        };
        npf_ioctl_table_t nct;
        fam_addr_mask_t fam;
        size_t buflen = 512;
        char *cmd, *arg;
        int n, alen;

        /* Default action is list. */
        memset(&nct, 0, sizeof(npf_ioctl_table_t));
        nct.nct_name = argv[0];
        cmd = argv[1];

        for (n = 0; tblops[n].cmd != NULL; n++) {
                if (strcmp(cmd, tblops[n].cmd) != 0) {
                        continue;
                }
                nct.nct_cmd = tblops[n].action;
                break;
        }
        if (tblops[n].cmd == NULL) {
                errx(EXIT_FAILURE, "invalid command '%s'", cmd);
        }

        switch (nct.nct_cmd) {
        case NPF_CMD_TABLE_LIST:
        case NPF_CMD_TABLE_FLUSH:
                arg = NULL;
                break;
        default:
                if (argc < 3) {
                        usage();
                }
                arg = argv[2];
        }

again:
        switch (nct.nct_cmd) {
        case NPF_CMD_TABLE_LIST:
                nct.nct_data.buf.buf = ecalloc(1, buflen);
                nct.nct_data.buf.len = buflen;
                break;
        case NPF_CMD_TABLE_FLUSH:
                break;
        default:
                if (!npfctl_parse_cidr(arg, &fam, &alen)) {
                        errx(EXIT_FAILURE, "invalid CIDR '%s'", arg);
                }
                nct.nct_data.ent.alen = alen;
                memcpy(&nct.nct_data.ent.addr, &fam.fam_addr, alen);
                nct.nct_data.ent.mask = fam.fam_mask;
        }

        if (ioctl(fd, IOC_NPF_TABLE, &nct) != -1) {
                errno = 0;
        }
        switch (errno) {
        case 0:
                break;
        case EEXIST:
                errx(EXIT_FAILURE, "entry already exists or is conflicting");
        case ENOENT:
                errx(EXIT_FAILURE, "not found");
        case EINVAL:
                errx(EXIT_FAILURE, "invalid address, mask or table ID");
        case ENOMEM:
                if (nct.nct_cmd == NPF_CMD_TABLE_LIST) {
                        /* XXX */
                        free(nct.nct_data.buf.buf);
                        buflen <<= 1;
                        goto again;
                }
                /* FALLTHROUGH */
        default:
                err(EXIT_FAILURE, "ioctl(IOC_NPF_TABLE)");
        }

        if (nct.nct_cmd == NPF_CMD_TABLE_LIST) {
                npf_ioctl_ent_t *ent = nct.nct_data.buf.buf;
                char *buf;

                while (nct.nct_data.buf.len--) {
                        if (!ent->alen)
                                break;
                        buf = npfctl_print_addrmask(ent->alen, "%a",
                            &ent->addr, ent->mask);
                        puts(buf);
                        ent++;
                }
                free(nct.nct_data.buf.buf);
        } else {
                printf("%s: %s\n", getprogname(),
                    nct.nct_cmd == NPF_CMD_TABLE_LOOKUP ?
                    "match" : "success");
        }
}

////////////////////////////////////////////////////////////////////////////
//
// NPFCTL CONNECTION COMMANDS
//

typedef struct {
        FILE *          fp;
        unsigned        alen;
        const char *    ifname;
        bool            nat;
        bool            nowide;
        bool            name;

        bool            v4;
        unsigned        pwidth;
} npf_conn_filter_t;

static int
npfctl_conn_print(unsigned alen, const npf_addr_t *a, const in_port_t *p,
    const char *ifname, void *arg)
{
        const npf_conn_filter_t *fil = arg;
        char *addrstr, *src, *dst;
        const char *fmt;
        FILE *fp = fil->fp;
        bool nat_conn;

        /*
         * Filter connection entries by IP version, interface and/or
         * applicability of NAT.
         */
        if (alen != fil->alen) {
                return 0;
        }
        if (fil->ifname && (!ifname || strcmp(ifname, fil->ifname) != 0)) {
                return 0;
        }
        nat_conn = !npfctl_addr_iszero(&a[2]) || p[2] != 0;
        if (fil->nat && !nat_conn) {
                return 0;
        }

        fmt = fil->name ? "%A" : (fil->v4 ? "%a" : "[%a]");

        addrstr = npfctl_print_addrmask(alen, fmt, &a[0], NPF_NO_NETMASK);
        easprintf(&src, "%s:%d", addrstr, p[0]);
        free(addrstr);

        addrstr = npfctl_print_addrmask(alen, fmt, &a[1], NPF_NO_NETMASK);
        easprintf(&dst, "%s:%d", addrstr, p[1]);
        free(addrstr);

        fprintf(fp, "%-*s %-*s ", fil->pwidth, src, fil->pwidth, dst);
        free(src);
        free(dst);

        fprintf(fp, "%-10s ", ifname ? ifname : "-");
        if (nat_conn) {
                addrstr = npfctl_print_addrmask(alen, fmt, &a[2], NPF_NO_NETMASK);
                fprintf(fp, "%s", addrstr);
                free(addrstr);
                if (p[2]) {
                        fprintf(fp, ":%d", p[2]);
                }
        }
        fputc('\n', fp);
        return 1;
}

static void
npf_conn_list_v(int fd, unsigned alen, npf_conn_filter_t *f)
{
        f->alen = alen;
        f->v4 = alen == sizeof(struct in_addr);
        f->pwidth = f->nowide ? 0 : ((f->v4 ? 15 : 40) + 1 + 5);
        if (npf_conn_list(fd, npfctl_conn_print, f) != 0) {
                err(EXIT_FAILURE, "npf_conn_list");
        }
}

int
npfctl_conn_list(int fd, int argc, char **argv)
{
        npf_conn_filter_t f;
        bool header = true;
        unsigned alen = 0;
        int c;

        argc--;
        argv++;

        memset(&f, 0, sizeof(f));
        f.fp = stdout;

        while ((c = getopt(argc, argv, "46hi:nNW")) != -1) {
                switch (c) {
                case '4':
                        alen = sizeof(struct in_addr);
                        break;
                case '6':
                        alen = sizeof(struct in6_addr);
                        break;
                case 'h':
                        header = false;
                        break;
                case 'i':
                        f.ifname = optarg;
                        break;
                case 'n':
                        f.nat = true;
                        break;
                case 'N':
                        f.name = true;
                        break;
                case 'W':
                        f.nowide = true;
                        break;
                default:
                        errx(EXIT_FAILURE,
                            "Usage: %s list [-46hnNW] [-i <ifname>]\n",
                            getprogname());
                }
        }

        if (header) {
                fprintf(f.fp, "# %-*s %-*s %-*s %s\n",
                    21 - 2, "src-addr:port",
                    21, "dst-addr:port",
                    10, "interface",
                    "nat-addr:port");
        }

        if (!alen || alen == sizeof(struct in_addr)) {
                npf_conn_list_v(fd, sizeof(struct in_addr), &f);
        }
        if (!alen || alen == sizeof(struct in6_addr)) {
                npf_conn_list_v(fd, sizeof(struct in6_addr), &f);
        }

        return 0;
}