/* -*- Mode: C; tab-width: 4 -*-
 *
 * Copyright (c) 2007-2012 Apple Inc. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#define _FORTIFY_SOURCE 2

#include <CoreFoundation/CoreFoundation.h>
#include <sys/cdefs.h>
#include <sys/time.h>
#include <sys/types.h>
#include <mach/mach.h>
#include <mach/mach_error.h>
#include <servers/bootstrap.h>
#include <launch.h>
#include <pwd.h>
#include <pthread.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
#include <Security/Security.h>
#include "helper.h"
#include "helper-server.h"
#include <xpc/private.h>

#if TARGET_OS_EMBEDDED
#define NO_SECURITYFRAMEWORK 1
#endif

#ifndef LAUNCH_JOBKEY_MACHSERVICES
#define LAUNCH_JOBKEY_MACHSERVICES "MachServices"
#define LAUNCH_DATA_MACHPORT 10
#define launch_data_get_machport launch_data_get_fd
#endif


int mDNSHelperLogEnabled = 0;
os_log_t  log_handle = NULL;

static dispatch_queue_t xpc_queue = NULL;
static int opt_debug;
static pthread_t idletimer_thread;

unsigned long maxidle = 15;
unsigned long actualidle = 3600;

CFRunLoopRef gRunLoop = NULL;
CFRunLoopTimerRef gTimer = NULL;


static void handle_sigterm(int sig)
{
    // os_log_debug(log_handle,"entry sig=%d", sig);	Can't use syslog from within a signal handler
    assert(sig == SIGTERM);
    helper_exit();
}

static void initialize_logging(void)
{
    log_handle   = os_log_create("com.apple.mDNSResponderHelper", "INFO");
    
    if (!log_handle)
    {
        // OS_LOG_DEFAULT is the default logging object, if you are not creating a custom subsystem/category
        os_log_error(OS_LOG_DEFAULT, "Could NOT create log handle in mDNSResponderHelper");
    }
    
}

static void initialize_id(void)
{
    static char login[] = "_mdnsresponder";
    struct passwd hardcode;
    struct passwd *pwd = &hardcode; // getpwnam(login);
    hardcode.pw_uid = 65;
    hardcode.pw_gid = 65;

    if (!pwd)
    {
        os_log(log_handle, "Could not find account name `%s'.  I will only help root.", login);
        return;
    }
    mDNSResponderUID = pwd->pw_uid;
    mDNSResponderGID = pwd->pw_gid;
}

static void diediedie(CFRunLoopTimerRef timer, void *context)
{
    os_log_info(log_handle, "entry %p %p %lu", timer, context, actualidle);
    
    assert(gTimer == timer);
    os_log_info(log_handle, "mDNSResponderHelper exiting after [%lu] seconds", actualidle);
    
    if (actualidle)
        helper_exit();
}

void pause_idle_timer(void)
{
    os_log_debug(log_handle,"entry");
    assert(gTimer);
    assert(gRunLoop);
    CFRunLoopRemoveTimer(gRunLoop, gTimer, kCFRunLoopDefaultMode);
}

void unpause_idle_timer(void)
{
    os_log_debug(log_handle,"entry");
    assert(gRunLoop);
    assert(gTimer);
    CFRunLoopAddTimer(gRunLoop, gTimer, kCFRunLoopDefaultMode);
}

void update_idle_timer(void)
{
    os_log_debug(log_handle,"entry");
    assert(gTimer);
    CFRunLoopTimerSetNextFireDate(gTimer, CFAbsoluteTimeGetCurrent() + actualidle);
}

static void *idletimer(void *context)
{
    os_log_debug(log_handle,"entry context=%p", context);
    gRunLoop = CFRunLoopGetMain();

    unpause_idle_timer();

    for (;;)
    {
        // os_log_debug(log_handle,"Running CFRunLoop");
        CFRunLoopRun();
        sleep(1);
    }

    return NULL;
}

static int initialize_timer()
{
    gTimer = CFRunLoopTimerCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + actualidle, actualidle, 0, 0, diediedie, NULL);
    int err = 0;
    os_log_info(log_handle, "mDNSResponderHelper initialize_timer() started");

    if (0 != (err = pthread_create(&idletimer_thread, NULL, idletimer, NULL)))
        os_log(log_handle, "Could not start idletimer thread: %s", strerror(err));

    return err;
}

/* 
 Reads the user's program arguments for mDNSResponderHelper
 For now we have only one option: mDNSHelperDebugLogging which is used to turn on mDNSResponderHelperLogging
 
 To turn ON mDNSResponderHelper Verbose Logging,
 1] sudo defaults write /Library/Preferences/com.apple.mDNSResponderHelper.plist mDNSHelperDebugLogging -bool YES
 2] sudo reboot
 
 To turn OFF mDNSResponderHelper Logging,
 1] sudo defaults delete /Library/Preferences/com.apple.mDNSResponderHelper.plist

 To view the current options set,
 1] plutil -p /Library/Preferences/com.apple.mDNSResponderHelper.plist
 OR
 1] sudo defaults read /Library/Preferences/com.apple.mDNSResponderHelper.plist
*/

static mDNSBool HelperPrefsGetValueBool(CFStringRef key, mDNSBool defaultVal)
{
    CFBooleanRef boolean;
    mDNSBool result = defaultVal;
    
    boolean = CFPreferencesCopyAppValue(key, kmDNSHelperProgramArgs);
    if (boolean)
    {
        if (CFGetTypeID(boolean) == CFBooleanGetTypeID())
            result = CFBooleanGetValue(boolean) ? mDNStrue : mDNSfalse;
        CFRelease(boolean);
    }
    
    return result;
}


// Verify Client's Entitlement
static mDNSBool check_entitlement(xpc_connection_t conn, const char *password)
{
    mDNSBool entitled = mDNSfalse;
    xpc_object_t ent = xpc_connection_copy_entitlement_value(conn, password);
    
    if (ent)
    {
        if (xpc_get_type(ent) == XPC_TYPE_BOOL && xpc_bool_get_value(ent))
        {
            entitled = mDNStrue;
        }
        xpc_release(ent);
    }
    else
    {
        os_log(log_handle, "client entitlement is NULL");
    }
    
    if (!entitled)
        os_log(log_handle, "entitlement check failed -> client is missing entitlement!");
    
    return entitled;
}


static void handle_request(xpc_object_t req)
{
    mDNSu32 helper_mode = 0;
    int error_code = 0;
    
    xpc_connection_t remote_conn = xpc_dictionary_get_remote_connection(req);
    xpc_object_t response = xpc_dictionary_create_reply(req);
    
    // switch here based on dictionary to handle different requests from mDNSResponder
    if ((xpc_dictionary_get_uint64(req, kHelperMode)))
    {
        os_log_info(log_handle, "Getting mDNSResponder request mode");
        helper_mode = (mDNSu32)(xpc_dictionary_get_uint64(req, kHelperMode));
    }
   
    switch (helper_mode)
    {
        case bpf_request:
        {
            os_log_info(log_handle, "Calling new RequestBPF()");
            RequestBPF();
            break;
        }
            
        case set_name:
        {
            const char *old_name;
            const char *new_name;
            int pref_key = 0;
            
            pref_key = (int)(xpc_dictionary_get_uint64(req, kPrefsNameKey));
            old_name = xpc_dictionary_get_string(req, kPrefsOldName);
            new_name = xpc_dictionary_get_string(req, kPrefsNewName);
            
            os_log_info(log_handle, "Calling new SetName() oldname: %s newname: %s key:%d", old_name, new_name, pref_key);
            PreferencesSetName(pref_key, old_name, new_name);
            break;
        }
            
        case p2p_packetfilter:
        {
            pfArray_t pfports;
            pfArray_t pfprotocols;
            const char *if_name;
            uint32_t cmd;
            uint32_t count;
            
            cmd = xpc_dictionary_get_uint64(req, "pf_opcode");
            if_name = xpc_dictionary_get_string(req, "pf_ifname");
            count = xpc_dictionary_get_uint64(req, "pf_count");
            
            pfports[0]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_port0");
            pfports[1]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_port1");
            pfports[2]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_port2");
            pfports[3]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_port3");
            
            pfprotocols[0]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_protocol0");
            pfprotocols[1]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_protocol1");
            pfprotocols[2]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_protocol2");
            pfprotocols[3]  = (uint16_t)xpc_dictionary_get_uint64(req, "pf_protocol3");
            
            os_log_info(log_handle,"Calling new PacketFilterControl()");
            PacketFilterControl(cmd, if_name, count, pfports, pfprotocols);
            break;
        }
            
        case user_notify:
        {
            const char *title;
            const char *msg;
            title = xpc_dictionary_get_string(req, "notify_title");
            msg   = xpc_dictionary_get_string(req, "notify_msg");
            
            os_log_info(log_handle,"Calling new UserNotify() title:%s msg:%s", title, msg);
            UserNotify(title, msg);
            break;
        }
            
        case power_req:
        {
            int key, interval;
            key        = xpc_dictionary_get_uint64(req, "powerreq_key");
            interval   = xpc_dictionary_get_uint64(req, "powerreq_interval");
            
            os_log_info(log_handle,"Calling new PowerRequest() key[%d] interval[%d]", key, interval);
            PowerRequest(key, interval, &error_code);
            break;
        }
            
        case send_wakepkt:
        {
            const char *ether_addr;
            const char *ip_addr;
            int iteration;
            unsigned int if_id;
            
            if_id = (unsigned int)xpc_dictionary_get_uint64(req, "interface_index");
            ether_addr = xpc_dictionary_get_string(req, "ethernet_address");
            ip_addr = xpc_dictionary_get_string(req, "ip_address");
            iteration = (int)xpc_dictionary_get_uint64(req, "swp_iteration");
            
            os_log_info(log_handle, "Calling new SendWakeupPacket() ether_addr[%s] ip_addr[%s] if_id[%d] iteration[%d]",
                           ether_addr, ip_addr, if_id, iteration);
            SendWakeupPacket(if_id, ether_addr, ip_addr, iteration);
            break;
        }
            
        case set_localaddr_cacheentry:
        {
            int if_index, family;
            
            if_index = xpc_dictionary_get_uint64(req, "slace_ifindex");
            family   = xpc_dictionary_get_uint64(req, "slace_family");
            
            const uint8_t* ip  = xpc_dictionary_get_data(req, "slace_ip", NULL);
            const uint8_t* eth = xpc_dictionary_get_data(req, "slace_eth", NULL);
            
            os_log_info(log_handle, "Calling new SetLocalAddressCacheEntry() if_index[%d] family[%d] ", if_index, family);

            SetLocalAddressCacheEntry(if_index, family, ip, eth, &error_code);
            
            /*
            static int v6addr_to_string(const v6addr_t addr, char *buf, size_t buflen)
            {
                if (NULL == inet_ntop(AF_INET6, addr, buf, buflen))
                {
                    os_log(log_handle, "inet_ntop failed: %s", strerror(errno));
                    return -1;
                }
                else
                {
                    return 0;
                }
            }

            ethaddr_t eth = { 0x33, 0x33, 0x00, 0x00, 0x00, 0x01 } ;
            const uint8_t* slace_ip = NULL;
            v6addr_t addr_ipv6;
            size_t ip_len;
            slace_ip = xpc_dictionary_get_data(req, "slace_ip", &ip_len);
            if (slace_ip && (ip_len == sizeof(v6addr_t)))
            {
                os_log(log_handle, "mDNSResponderHelper: doing memcpy()");
                memcpy(&addr_ipv6, slace_ip, ip_len);
            }
            char test_ipv6_str[46];
            v6addr_to_string(addr_ipv6, test_ipv6_str, sizeof(test_ipv6_str));
            os_log(log_handle, "mDNSResponderHelper: handle_request: set_localaddr_cacheentry: test_ipv6_str is %s", test_ipv6_str);
            */
                        
            break;
        }
            
        case send_keepalive:
        {
            uint16_t lport, rport, win;
            uint32_t seq, ack;
            
            lport = xpc_dictionary_get_uint64(req, "send_keepalive_lport");
            rport = xpc_dictionary_get_uint64(req, "send_keepalive_rport");
            seq   = xpc_dictionary_get_uint64(req, "send_keepalive_seq");
            ack   = xpc_dictionary_get_uint64(req, "send_keepalive_ack");
            win   = xpc_dictionary_get_uint64(req, "send_keepalive_win");
            
            const uint8_t* sadd6 = xpc_dictionary_get_data(req, "send_keepalive_sadd", NULL);
            const uint8_t* dadd6 = xpc_dictionary_get_data(req, "send_keepalive_dadd", NULL);
            
            os_log_info(log_handle, "helper-main: handle_request: send_keepalive: lport is[%d] rport is[%d] seq is[%d] ack is[%d] win is[%d]",
                           lport, rport, seq, ack, win);
            
            SendKeepalive(sadd6, dadd6, lport, rport, seq, ack, win);
            break;
        }
    
        case retreive_tcpinfo:
        {
            uint16_t lport, rport;
            int family;
            uint32_t seq, ack;
            uint16_t win;
            int32_t  intfid;
            
            lport    = xpc_dictionary_get_uint64(req, "retreive_tcpinfo_lport");
            rport    = xpc_dictionary_get_uint64(req, "retreive_tcpinfo_rport");
            family   = xpc_dictionary_get_uint64(req, "retreive_tcpinfo_family");
            
            const uint8_t* laddr = xpc_dictionary_get_data(req, "retreive_tcpinfo_laddr", NULL);
            const uint8_t* raddr = xpc_dictionary_get_data(req, "retreive_tcpinfo_raddr", NULL);
            
            os_log_info(log_handle, "helper-main: handle_request: retreive_tcpinfo: lport is[%d] rport is[%d] family is [%d]",
                           lport, rport, family);
            
            RetrieveTCPInfo(family, laddr, lport, raddr, rport, &seq, &ack, &win, &intfid, &error_code);
            
            if (response)
            {
                xpc_dictionary_set_uint64(response, "retreive_tcpinfo_seq",  seq);
                xpc_dictionary_set_uint64(response, "retreive_tcpinfo_ack",  ack);
                xpc_dictionary_set_uint64(response, "retreive_tcpinfo_win",  win);
                xpc_dictionary_set_uint64(response, "retreive_tcpinfo_ifid", intfid);
            }
            
            os_log_info(log_handle, "helper-main: handle_request: retreive_tcpinfo: seq is[%d] ack is[%d] win is [%d] intfid is [%d]",
                           seq, ack, win, intfid);

            break;
        }
            
        case autotunnel_setkeys:
        {
            uint16_t lport, rport;
            int replace_del;
            const char *fqdnstr;
            
            lport        = xpc_dictionary_get_uint64(req, "autotunnelsetkeys_lport");
            rport        = xpc_dictionary_get_uint64(req, "autotunnelsetkeys_rport");
            replace_del  = xpc_dictionary_get_uint64(req, "autotunnelsetkeys_repdel");

            const uint8_t* local_inner  =  xpc_dictionary_get_data(req, "autotunnelsetkeys_localinner", NULL);
            const uint8_t* local_outer  =  xpc_dictionary_get_data(req, "autotunnelsetkeys_localouter", NULL);
            const uint8_t* remote_inner =  xpc_dictionary_get_data(req, "autotunnelsetkeys_remoteinner", NULL);
            const uint8_t* remote_outer =  xpc_dictionary_get_data(req, "autotunnelsetkeys_remoteouter", NULL);
            
            fqdnstr = xpc_dictionary_get_string(req, "autotunnelsetkeys_fqdnStr");
            
            os_log_info(log_handle, "helper-main: handle_request: autotunnel_setkeys: lport is[%d] rport is[%d] replace_del is [%d]",
                        lport, rport, replace_del);
            

            HelperAutoTunnelSetKeys(replace_del, local_inner, local_outer, lport, remote_inner, remote_outer, rport, fqdnstr, &error_code);

            break;
        }

        
        case keychain_getsecrets:
        {
            unsigned int num_sec  = 0;
            unsigned long secrets = 0;
            unsigned int sec_cnt  = 0;
            
            os_log_info(log_handle,"Calling new KeyChainGetSecrets()");
            
            KeychainGetSecrets(&num_sec, &secrets, &sec_cnt, &error_code);
            
            if (response)
            {
                xpc_dictionary_set_uint64(response, "keychain_num_secrets",   num_sec);
                xpc_dictionary_set_data(response, "keychain_secrets", (void *)secrets, sec_cnt);
                xpc_dictionary_set_uint64(response, "keychain_secrets_count", sec_cnt);
            }
            
            os_log_info(log_handle,"helper-main: handle_request: keychain_getsecrets: num_secrets is %d, secrets is %lu, secrets_Cnt is %d",
                           num_sec, secrets, sec_cnt);
            
            if (secrets)
                vm_deallocate(mach_task_self(), secrets, sec_cnt);
            
            break;
        }
            
        default:
        {
            os_log(log_handle, "handle_request: Unrecognized mode!");
            error_code  = kHelperErr_UndefinedMode;
            break;
        }
    }
    
    // Return Response Status back to the client (essentially ACKing the request)
    if (response)
    {
        xpc_dictionary_set_uint64(response, kHelperReplyStatus, kHelperReply_ACK);
        xpc_dictionary_set_int64(response, kHelperErrCode, error_code);
        xpc_connection_send_message(remote_conn, response);
        xpc_release(response);
    }
    else
    {
        os_log(log_handle, "handle_requests: Response Dictionary could not be created!");
        return;
    }
    
}

static void accept_client(xpc_connection_t conn)
{
    int c_pid = xpc_connection_get_pid(conn);
    
    if (!(check_entitlement(conn, kHelperService)))
    {
        os_log(log_handle, "accept_client: Helper Client PID[%d] is missing Entitlement. Cancelling connection", c_pid);
        xpc_connection_cancel(conn);
        return;
    }
    
    xpc_retain(conn);
    xpc_connection_set_target_queue(conn, xpc_queue);
    xpc_connection_set_event_handler(conn, ^(xpc_object_t req_msg)
    {
        xpc_type_t type = xpc_get_type(req_msg);
                                         
        if (type == XPC_TYPE_DICTIONARY)
        {
            os_log_info(log_handle,"accept_client:conn:[%p] client[%d](mDNSResponder) requesting service", (void *) conn, c_pid);
            handle_request(req_msg);
        }
        else // We hit this case ONLY if Client Terminated Connection OR Crashed
        {
            os_log(log_handle, "accept_client:conn:[%p] client[%d](mDNSResponder) teared down the connection (OR Crashed)", (void *) conn, c_pid);
            // handle_termination();
            xpc_release(conn);
        }
    });
    
    xpc_connection_resume(conn);
}


static void init_helper_service(const char *service_name)
{
    
    xpc_connection_t xpc_listener = xpc_connection_create_mach_service(service_name, NULL, XPC_CONNECTION_MACH_SERVICE_LISTENER);
    if (!xpc_listener || xpc_get_type(xpc_listener) != XPC_TYPE_CONNECTION)
    {
        os_log(log_handle, "init_helper_service: Error Creating XPC Listener for mDNSResponderHelperService !!");
        return;
    }
    
    os_log_info(log_handle,"init_helper_service: XPC Listener for mDNSResponderHelperService Listening");
    
    xpc_queue = dispatch_queue_create("com.apple.mDNSHelper.service_queue", NULL);
    
    xpc_connection_set_event_handler(xpc_listener, ^(xpc_object_t eventmsg)
    {
        xpc_type_t type = xpc_get_type(eventmsg);
                                         
        if (type == XPC_TYPE_CONNECTION)
        {
            os_log_info(log_handle,"init_helper_service: new mDNSResponderHelper Client %p", eventmsg);
            accept_client(eventmsg);
        }
        else if (type == XPC_TYPE_ERROR) // Ideally, we would never hit these cases below
        {
            os_log(log_handle, "init_helper_service: XPCError: %s", xpc_dictionary_get_string(eventmsg, XPC_ERROR_KEY_DESCRIPTION));
            return;
        }
        else
        {
            os_log(log_handle, "init_helper_service: Unknown EventMsg type");
            return;
        }
    });
    
    xpc_connection_resume(xpc_listener);
}


int main(int ac, char *av[])
{
    char *p = NULL;
    long n;
    int ch;

    while ((ch = getopt(ac, av, "dt:")) != -1)
    {
        switch (ch)
        {
            case 'd':
                opt_debug = 1;
                break;
            case 't':
                n = strtol(optarg, &p, 0);
                if ('\0' == optarg[0] || '\0' != *p || n > LONG_MAX || n < 0)
                {
                    fprintf(stderr, "Invalid idle timeout: %s\n", optarg);
                    exit(EXIT_FAILURE);
                }
                maxidle = n;
                break;
            case '?':
            default:
                fprintf(stderr, "Usage: mDNSResponderHelper [-d] [-t maxidle]\n");
                exit(EXIT_FAILURE);
        }
    }
    ac -= optind;
    av += optind;
    (void)ac; // Unused
    (void)av; // Unused

    initialize_logging();
    initialize_id();

    mDNSHelperLogEnabled = HelperPrefsGetValueBool(kPreferencesKey_mDNSHelperLog, mDNSHelperLogEnabled);

// Currently on Fuji/Whitetail releases we are keeping the logging always enabled.
// Hence mDNSHelperLogEnabled is set to true below by default.
    mDNSHelperLogEnabled      = 1;

    os_log_info(log_handle,"mDNSResponderHelper Starting to run");

#ifndef NO_SECURITYFRAMEWORK
    // We should normally be running as a system daemon.  However, that might not be the case in some scenarios (e.g. debugging).
    // Explicitly ensure that our Keychain operations utilize the system domain.
    if (opt_debug)
        SecKeychainSetPreferenceDomain(kSecPreferencesDomainSystem);
#endif

    if (maxidle)
        actualidle = maxidle;

    signal(SIGTERM, handle_sigterm);

    if (initialize_timer())
        exit(EXIT_FAILURE);
    for (n=0; n<100000; n++)
        if (!gRunLoop)
            usleep(100);
    
    if (!gRunLoop)
    {
        os_log(log_handle, "gRunLoop not set after waiting");
        exit(EXIT_FAILURE);
    }

    init_helper_service(kHelperService);
    os_log_info(log_handle,"mDNSResponderHelper is now running");
    dispatch_main();
    
}

// Note: The C preprocessor stringify operator ('#') makes a string from its argument, without macro expansion
// e.g. If "version" is #define'd to be "4", then STRINGIFY_AWE(version) will return the string "version", not "4"
// To expand "version" to its value before making the string, use STRINGIFY(version) instead
#define STRINGIFY_ARGUMENT_WITHOUT_EXPANSION(s) # s
#define STRINGIFY(s) STRINGIFY_ARGUMENT_WITHOUT_EXPANSION(s)

// For convenience when using the "strings" command, this is the last thing in the file
// The "@(#) " pattern is a special prefix the "what" command looks for
const char VersionString_SCCS[] = "@(#) mDNSResponderHelper " STRINGIFY(mDNSResponderVersion) " (" __DATE__ " " __TIME__ ")";

#if _BUILDING_XCODE_PROJECT_
// If the process crashes, then this string will be magically included in the automatically-generated crash log
const char *__crashreporter_info__ = VersionString_SCCS + 5;
asm (".desc ___crashreporter_info__, 0x10");
#endif