/*
 * allow_address related functions
 *
 * Copyright (C) 2006 Juha Heinanen
 *
 * This file is part of Kamailio, a free SIP server.
 *
 * Kamailio is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version
 *
 * Kamailio is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 *
 */

#include <sys/types.h>
#include <regex.h>
#include <string.h>
#include <arpa/inet.h>

#include "permissions.h"
#include "hash.h"
#include "../../core/config.h"
#include "../../lib/srdb1/db.h"
#include "../../core/ip_addr.h"
#include "../../core/resolve.h"
#include "../../core/mem/shm_mem.h"
#include "../../core/parser/msg_parser.h"
#include "../../core/parser/parse_from.h"
#include "../../core/usr_avp.h"
#include "../../core/mod_fix.h"
#include "../../core/ut.h"
#include "../../core/resolve.h"

#define TABLE_VERSION 6

struct addr_list ***perm_addr_table =
		NULL; /* Ptr to current address hash table ptr */
struct addr_list **perm_addr_table_1 =
		NULL; /* Pointer to address hash table 1 */
struct addr_list **perm_addr_table_2 =
		NULL; /* Pointer to address hash table 2 */

struct subnet **perm_subnet_table = NULL;  /* Ptr to current subnet table */
struct subnet *perm_subnet_table_1 = NULL; /* Ptr to subnet table 1 */
struct subnet *perm_subnet_table_2 = NULL; /* Ptr to subnet table 2 */

struct domain_name_list ***perm_domain_table =
		NULL; /* Ptr to current domain name table */
static struct domain_name_list **perm_domain_table_1 =
		NULL; /* Ptr to domain name table 1 */
static struct domain_name_list **perm_domain_table_2 =
		NULL; /* Ptr to domain name table 2 */

static db1_con_t *perm_db_handle = 0;
static db_func_t perm_dbf;

extern str perm_address_file;

typedef struct address_tables_group
{
	struct addr_list **address_table;
	struct subnet *subnet_table;
	struct domain_name_list **domain_table;

} address_tables_group_t;

static inline ip_addr_t *strtoipX(str *ips)
{
	/* try to figure out INET class */
	if(ips->s[0] == '[' || memchr(ips->s, ':', ips->len) != NULL) {
		/* IPv6 */
		return str2ip6(ips);
	} else {
		/* IPv4 */
		return str2ip(ips);
	}
}

int reload_address_insert(address_tables_group_t *atg, unsigned int gid,
		str *ips, unsigned int mask, unsigned int port, str *tagv)
{
	ip_addr_t *ipa;

	ipa = strtoipX(ips);
	if(ipa == NULL) {
		LM_DBG("Domain name: %.*s\n", ips->len, ips->s);
		/* return -1; */
	} else {
		if(ipa->af == AF_INET6) {
			if((int)mask < 0 || mask > 128) {
				LM_DBG("failure during IP mask check for v6\n");
				return -1;
			}
			if(mask == 0) {
				mask = 128;
			}
		} else {
			if((int)mask < 0 || mask > 32) {
				LM_DBG("failure during IP mask check for v4\n");
				return -1;
			}
			if(mask == 0) {
				mask = 32;
			}
		}
	}

	if(ipa != NULL) {
		if((ipa->af == AF_INET6 && mask == 128)
				|| (ipa->af == AF_INET && mask == 32)) {
			if(addr_hash_table_insert(atg->address_table, gid, ipa, port, tagv)
					== -1) {
				LM_ERR("hash table problem\n");
				return -1;
			}
			LM_DBG("Tuple <%u, %.*s, %u> inserted into address hash table\n",
					gid, ips->len, ips->s, port);
		} else {
			if(subnet_table_insert(
					   atg->subnet_table, gid, ipa, mask, port, tagv)
					== -1) {
				LM_ERR("subnet table problem\n");
				return -1;
			}
			LM_DBG("Tuple <%u, %.*s, %u, %u> inserted into subnet table\n", gid,
					ips->len, ips->s, port, mask);
		}
	} else {
		if(domain_name_table_insert(atg->domain_table, gid, ips, port, tagv)
				== -1) {
			LM_ERR("domain name table problem\n");
			return -1;
		}
		LM_DBG("Tuple <%u, %.*s, %u> inserted into domain name table\n", gid,
				ips->len, ips->s, port);
	}
	return 0;
}

/*
 * Reload addr table from database to new hash table and when done, make new hash table
 * current one.
 */
int reload_address_db_table(address_tables_group_t *atg)
{
	db_key_t cols[5];
	db1_res_t *res = NULL;
	db_row_t *row;
	db_val_t *val;

	int i;
	unsigned int gid;
	unsigned int port;
	unsigned int mask;
	str ips;
	str tagv;

	cols[0] = &perm_grp_col;
	cols[1] = &perm_ip_addr_col;
	cols[2] = &perm_mask_col;
	cols[3] = &perm_port_col;
	cols[4] = &perm_tag_col;

	if(perm_dbf.use_table(perm_db_handle, &perm_address_table) < 0) {
		LM_ERR("failed to use table\n");
		return -1;
	}

	if(perm_dbf.query(perm_db_handle, NULL, 0, NULL, cols, 0, 5, 0, &res) < 0) {
		LM_ERR("failed to query database\n");
		return -1;
	}

	row = RES_ROWS(res);

	LM_DBG("Number of rows in address table: %d\n", RES_ROW_N(res));

	for(i = 0; i < RES_ROW_N(res); i++) {
		val = ROW_VALUES(row + i);
		/* basic checks to db values */
		if(ROW_N(row + i) != 5) {
			LM_DBG("failure during checks of db address table: Columns %d - "
				   "expected 5\n",
					ROW_N(row + i));
			goto dberror;
		}
		if((VAL_TYPE(val) != DB1_INT) || VAL_NULL(val) || (VAL_INT(val) <= 0)) {
			LM_DBG("failure during checks of database value 1 (group) in "
				   "address table\n");
			goto dberror;
		}
		if((VAL_TYPE(val + 1) != DB1_STRING)
				&& (VAL_TYPE(val + 1) != DB1_STR)) {
			LM_DBG("failure during checks of database value 2 (IP address) in "
				   "address table - not a string value\n");
			goto dberror;
		}
		if(VAL_NULL(val + 1)) {
			LM_DBG("failure during checks of database value 2 (IP address) in "
				   "address table - NULL value not permitted\n");
			goto dberror;
		}
		if((VAL_TYPE(val + 2) != DB1_INT) || VAL_NULL(val + 2)) {
			LM_DBG("failure during checks of database value 3 (subnet "
				   "size/CIDR) in address table\n");
			goto dberror;
		}
		if((VAL_TYPE(val + 3) != DB1_INT) || VAL_NULL(val + 3)) {
			LM_DBG("failure during checks of database value 4 (port) in "
				   "address table\n");
			goto dberror;
		}
		gid = VAL_UINT(val);
		ips.s = (char *)VAL_STRING(val + 1);
		ips.len = strlen(ips.s);
		mask = VAL_UINT(val + 2);
		port = VAL_UINT(val + 3);
		tagv.s = VAL_NULL(val + 4) ? NULL : (char *)VAL_STRING(val + 4);
		if(tagv.s != NULL) {
			tagv.len = strlen(tagv.s);
		}
		if(reload_address_insert(atg, gid, &ips, mask, port, &tagv) < 0) {
			goto dberror;
		}
	}

	perm_dbf.free_result(perm_db_handle, res);

	return 1;

dberror:
	LM_ERR("database problem - invalid record\n");
	perm_dbf.free_result(perm_db_handle, res);
	return -1;
}

/**
 * macros for parsing address file
 */
#define PERM_FADDR_SKIPWS(p)                                                 \
	do {                                                                     \
		while(*p && (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\n')) { \
			p++;                                                             \
		}                                                                    \
	} while(0)

#define PERM_FADDR_PARSESTR(p, vstr)                                    \
	do {                                                                \
		vstr.s = p;                                                     \
		while(*p && *p != ' ' && *p != '\t' && *p != '\r' && *p != '\n' \
				&& *p != '#') {                                         \
			p++;                                                        \
		}                                                               \
		vstr.len = p - vstr.s;                                          \
	} while(0)

#define PERM_FADDR_PARSENUM(p, vnum)       \
	do {                                   \
		vnum = 0;                          \
		while(*p >= '0' && *p <= '9') {    \
			vnum = vnum * 10 + (*p - '0'); \
			p++;                           \
		}                                  \
	} while(0)

/* end-of-data jump at start of comment or end-of-line */
#define PERM_FADDR_EODJUMP(p, jumplabel) \
	do {                                 \
		if(*p == '\0' || *p == '#') {    \
			goto jumplabel;              \
		}                                \
	} while(0)

/*
 * Reload addr table from file to new hash table and when done, make new hash table
 * current one.
 */
int reload_address_file_table(address_tables_group_t *atg)
{
	char line[1024], *p;
	FILE *f = NULL;
	int i = 0;
	int n = 0;
	unsigned int gid;
	unsigned int mask;
	unsigned int port;
	str ips;
	str tagv;

	f = fopen(perm_address_file.s, "r");
	if(f == NULL) {
		LM_ERR("can't open list file [%s]\n", perm_address_file.s);
		return -1;
	}

	p = fgets(line, 1024, f);
	while(p) {
		i++;
		gid = 0;
		ips.s = NULL;
		ips.len = 0;
		mask = 0;
		port = 0;
		tagv.s = NULL;
		tagv.len = 0;

		/* comment line */
		PERM_FADDR_SKIPWS(p);
		PERM_FADDR_EODJUMP(p, next_line);

		/* group id */
		PERM_FADDR_PARSENUM(p, gid);

		PERM_FADDR_SKIPWS(p);
		PERM_FADDR_EODJUMP(p, error);

		/* address - ip/domain */
		PERM_FADDR_PARSESTR(p, ips);

		PERM_FADDR_SKIPWS(p);
		PERM_FADDR_EODJUMP(p, add_record);

		/* mask */
		PERM_FADDR_PARSENUM(p, mask);

		PERM_FADDR_SKIPWS(p);
		PERM_FADDR_EODJUMP(p, add_record);

		/* port */
		PERM_FADDR_PARSENUM(p, port);

		PERM_FADDR_SKIPWS(p);
		PERM_FADDR_EODJUMP(p, add_record);

		/* tag */
		PERM_FADDR_PARSESTR(p, tagv);

	add_record:
		if(reload_address_insert(atg, gid, &ips, mask, port, &tagv) < 0) {
			goto error;
		}
		n++;

	next_line:
		p = fgets(line, 1024, f);
	}

	LM_DBG("processed file: %s (%d lines)- added %d records\n",
			perm_address_file.s, i, n);

	fclose(f);
	return 1;

error:
	if(f != NULL) {
		fclose(f);
	}
	return -1;
}

/*
 * Reload addr table to new hash table and when done, make new hash table
 * current one.
 */
int reload_address_table(void)
{
	int ret = 0;
	address_tables_group_t atg;

	/* Choose new hash table and free its old contents */
	if(*perm_addr_table == perm_addr_table_1) {
		empty_addr_hash_table(perm_addr_table_2);
		atg.address_table = perm_addr_table_2;
	} else {
		empty_addr_hash_table(perm_addr_table_1);
		atg.address_table = perm_addr_table_1;
	}

	/* Choose new subnet table */
	if(*perm_subnet_table == perm_subnet_table_1) {
		empty_subnet_table(perm_subnet_table_2);
		atg.subnet_table = perm_subnet_table_2;
	} else {
		empty_subnet_table(perm_subnet_table_1);
		atg.subnet_table = perm_subnet_table_1;
	}

	/* Choose new domain name table */
	if(*perm_domain_table == perm_domain_table_1) {
		empty_domain_name_table(perm_domain_table_2);
		atg.domain_table = perm_domain_table_2;
	} else {
		empty_domain_name_table(perm_domain_table_1);
		atg.domain_table = perm_domain_table_1;
	}

	if(perm_address_file.s == NULL) {
		ret = reload_address_db_table(&atg);
	} else {
		ret = reload_address_file_table(&atg);
	}
	if(ret != 1) {
		return ret;
	}

	*perm_addr_table = atg.address_table;
	*perm_subnet_table = atg.subnet_table;
	*perm_domain_table = atg.domain_table;

	LM_DBG("address table reloaded successfully.\n");


	return ret;
}

/*
 * Wrapper to reload addr table from mi or rpc
 * we need to open the db_handle
 */
int reload_address_table_cmd(void)
{
	if(perm_address_file.s == NULL) {
		if(!perm_db_url.s) {
			LM_ERR("db_url not set\n");
			return -1;
		}

		if(!perm_db_handle) {
			perm_db_handle = perm_dbf.init(&perm_db_url);
			if(!perm_db_handle) {
				LM_ERR("unable to connect database\n");
				return -1;
			}
		}
	}

	if(reload_address_table() != 1) {
		if(perm_address_file.s == NULL) {
			perm_dbf.close(perm_db_handle);
			perm_db_handle = 0;
		}
		return -1;
	}

	if(perm_address_file.s == NULL) {
		perm_dbf.close(perm_db_handle);
		perm_db_handle = 0;
	}

	return 1;
}

/*
 * Initialize data structures
 */
int init_addresses(void)
{
	perm_addr_table_1 = perm_addr_table_2 = 0;
	perm_addr_table = 0;

	if(perm_address_file.s == NULL) {
		if(!perm_db_url.s) {
			LM_INFO("db_url parameter of permissions module not set, "
					"disabling allow_address\n");
			return 0;
		} else {
			if(db_bind_mod(&perm_db_url, &perm_dbf) < 0) {
				LM_ERR("load a database support module\n");
				return -1;
			}

			if(!DB_CAPABILITY(perm_dbf, DB_CAP_QUERY)) {
				LM_ERR("database module does not implement 'query' function\n");
				return -1;
			}
		}

		perm_db_handle = perm_dbf.init(&perm_db_url);
		if(!perm_db_handle) {
			LM_ERR("unable to connect database\n");
			return -1;
		}

		if(db_check_table_version(&perm_dbf, perm_db_handle,
				   &perm_address_table, TABLE_VERSION)
				< 0) {
			DB_TABLE_VERSION_ERROR(perm_address_table);
			perm_dbf.close(perm_db_handle);
			perm_db_handle = 0;
			return -1;
		}
	}

	perm_addr_table_1 = new_addr_hash_table();
	if(!perm_addr_table_1)
		return -1;

	perm_addr_table_2 = new_addr_hash_table();
	if(!perm_addr_table_2)
		goto error;

	perm_addr_table =
			(struct addr_list ***)shm_malloc(sizeof(struct addr_list **));
	if(!perm_addr_table) {
		LM_ERR("no more shm memory for addr_hash_table\n");
		goto error;
	}

	*perm_addr_table = perm_addr_table_1;

	perm_subnet_table_1 = new_subnet_table();
	if(!perm_subnet_table_1)
		goto error;

	perm_subnet_table_2 = new_subnet_table();
	if(!perm_subnet_table_2)
		goto error;

	perm_subnet_table = (struct subnet **)shm_malloc(sizeof(struct subnet *));
	if(!perm_subnet_table) {
		LM_ERR("no more shm memory for subnet_table\n");
		goto error;
	}

	*perm_subnet_table = perm_subnet_table_1;

	perm_domain_table_1 = new_domain_name_table();
	if(!perm_domain_table_1)
		goto error;

	perm_domain_table_2 = new_domain_name_table();
	if(!perm_domain_table_2)
		goto error;

	perm_domain_table = (struct domain_name_list ***)shm_malloc(
			sizeof(struct domain_name_list **));
	if(!perm_domain_table) {
		LM_ERR("no more shm memory for domain name table\n");
		goto error;
	}

	*perm_domain_table = perm_domain_table_1;


	if(reload_address_table() == -1) {
		LM_CRIT("reload of address table failed\n");
		goto error;
	}

	if(perm_address_file.s == NULL) {
		perm_dbf.close(perm_db_handle);
		perm_db_handle = 0;
	}

	return 0;

error:
	if(perm_addr_table_1) {
		free_addr_hash_table(perm_addr_table_1);
		perm_addr_table_1 = 0;
	}
	if(perm_addr_table_2) {
		free_addr_hash_table(perm_addr_table_2);
		perm_addr_table_2 = 0;
	}
	if(perm_addr_table) {
		shm_free(perm_addr_table);
		perm_addr_table = 0;
	}
	if(perm_subnet_table_1) {
		free_subnet_table(perm_subnet_table_1);
		perm_subnet_table_1 = 0;
	}
	if(perm_subnet_table_2) {
		free_subnet_table(perm_subnet_table_2);
		perm_subnet_table_2 = 0;
	}
	if(perm_subnet_table) {
		shm_free(perm_subnet_table);
		perm_subnet_table = 0;
	}

	if(perm_domain_table_1) {
		free_domain_name_table(perm_domain_table_1);
		perm_domain_table_1 = 0;
	}
	if(perm_domain_table_2) {
		free_domain_name_table(perm_domain_table_2);
		perm_domain_table_2 = 0;
	}
	if(perm_domain_table) {
		shm_free(perm_domain_table);
		perm_domain_table = 0;
	}

	if(perm_address_file.s == NULL) {
		perm_dbf.close(perm_db_handle);
		perm_db_handle = 0;
	}
	return -1;
}


/*
 * Close connections and release memory
 */
void clean_addresses(void)
{
	if(perm_addr_table_1)
		free_addr_hash_table(perm_addr_table_1);
	if(perm_addr_table_2)
		free_addr_hash_table(perm_addr_table_2);
	if(perm_addr_table)
		shm_free(perm_addr_table);
	if(perm_subnet_table_1)
		free_subnet_table(perm_subnet_table_1);
	if(perm_subnet_table_2)
		free_subnet_table(perm_subnet_table_2);
	if(perm_subnet_table)
		shm_free(perm_subnet_table);
	if(perm_domain_table_1)
		free_domain_name_table(perm_domain_table_1);
	if(perm_domain_table_2)
		free_domain_name_table(perm_domain_table_2);
	if(perm_domain_table)
		shm_free(perm_domain_table);
}


int allow_address(sip_msg_t *_msg, int addr_group, str *ips, int port)
{
	struct ip_addr *ipa;

	ipa = strtoipX(ips);

	if(ipa) {
		if(perm_addr_table
				&& match_addr_hash_table(*perm_addr_table, addr_group, ipa,
						   (unsigned int)port)
						   == 1) {
			return 1;
		} else {
			if(perm_subnet_table) {
				return match_subnet_table(*perm_subnet_table, addr_group, ipa,
						(unsigned int)port);
			}
		}
	} else {
		if(perm_domain_table) {
			return match_domain_name_table(
					*perm_domain_table, addr_group, ips, (unsigned int)port);
		}
	}
	return -1;
}

/*
 * Checks if an entry exists in cached address table that belongs to a
 * given address group and has given ip address and port.  Port value
 * 0 in cached address table matches any port.
 */
int w_allow_address(
		struct sip_msg *_msg, char *_addr_group, char *_addr_sp, char *_port_sp)
{
	int port;
	int addr_group;
	str ips;

	if(fixup_get_ivalue(_msg, (gparam_p)_addr_group, &addr_group) != 0) {
		LM_ERR("cannot get group value\n");
		return -1;
	}

	if(_addr_sp == NULL
			|| (fixup_get_svalue(_msg, (gparam_p)_addr_sp, &ips) < 0)) {
		LM_ERR("cannot get value of address pvar\n");
		return -1;
	}

	if(_port_sp == NULL
			|| (fixup_get_ivalue(_msg, (gparam_p)_port_sp, &port) < 0)) {
		LM_ERR("cannot get value of port pvar\n");
		return -1;
	}

	return allow_address(_msg, addr_group, &ips, port);
}

int allow_source_address(sip_msg_t *_msg, int addr_group)
{
	LM_DBG("looking for <%u, %x, %u>\n", addr_group,
			_msg->rcv.src_ip.u.addr32[0], _msg->rcv.src_port);

	if(perm_addr_table
			&& match_addr_hash_table(*perm_addr_table, addr_group,
					   &_msg->rcv.src_ip, _msg->rcv.src_port)
					   == 1) {
		return 1;
	} else {
		if(perm_subnet_table) {
			return match_subnet_table(*perm_subnet_table, addr_group,
					&_msg->rcv.src_ip, _msg->rcv.src_port);
		}
	}
	return -1;
}

/*
 * w_allow_source_address("group") equals to allow_address("group", "$si", "$sp")
 * but is faster.
 */
int w_allow_source_address(struct sip_msg *_msg, char *_addr_group, char *_str2)
{
	int addr_group = 1;

	if(_addr_group != NULL
			&& fixup_get_ivalue(_msg, (gparam_p)_addr_group, &addr_group)
					   != 0) {
		LM_ERR("cannot get group value\n");
		return -1;
	}
	return allow_source_address(_msg, addr_group);
}


/*
 * Checks if source address/port is found in cached address or
 * subnet table in any group. If yes, returns that group. If not returns -1.
 * Port value 0 in cached address and group table matches any port.
 */
int ki_allow_source_address_group(sip_msg_t *_msg)
{
	int group = -1;

	LM_DBG("looking for <%x, %u> in address table\n",
			_msg->rcv.src_ip.u.addr32[0], _msg->rcv.src_port);
	if(perm_addr_table) {
		group = find_group_in_addr_hash_table(
				*perm_addr_table, &_msg->rcv.src_ip, _msg->rcv.src_port);
		LM_DBG("Found <%d>\n", group);

		if(group != -1)
			return group;
	}

	LM_DBG("looking for <%x, %u> in subnet table\n",
			_msg->rcv.src_ip.u.addr32[0], _msg->rcv.src_port);
	if(perm_subnet_table) {
		group = find_group_in_subnet_table(
				*perm_subnet_table, &_msg->rcv.src_ip, _msg->rcv.src_port);
	}
	LM_DBG("Found <%d>\n", group);
	return group;
}

/*
 * Checks if source address/port is found in cached address or
 * subnet table in any group. If yes, returns that group. If not returns -1.
 * Port value 0 in cached address and group table matches any port.
 */
int allow_source_address_group(struct sip_msg *_msg, char *_str1, char *_str2)
{
	return ki_allow_source_address_group(_msg);
}

/*
 * Checks if address/port is found in cached address or
 * subnet table in any group. If yes, returns that group. If not returns -1.
 * Port value 0 in cached address and group table matches any port.
 */
int ki_allow_address_group(sip_msg_t *_msg, str *_addr, int _port)
{
	int group = -1;

	ip_addr_t *ipa;

	ipa = strtoipX(_addr);

	if(ipa) {
		LM_DBG("looking for <%.*s, %u> in address table\n", _addr->len,
				_addr->s, (unsigned int)_port);
		if(perm_addr_table) {
			group = find_group_in_addr_hash_table(
					*perm_addr_table, ipa, (unsigned int)_port);
			LM_DBG("Found address in group <%d>\n", group);

			if(group != -1)
				return group;
		}
		if(perm_subnet_table) {
			LM_DBG("looking for <%.*s, %u> in subnet table\n", _addr->len,
					_addr->s, _port);
			group = find_group_in_subnet_table(
					*perm_subnet_table, ipa, (unsigned int)_port);
			LM_DBG("Found a match of subnet in group <%d>\n", group);
		}
	} else {
		LM_DBG("looking for <%.*s, %u> in domain_name table\n", _addr->len,
				_addr->s, (unsigned int)_port);
		if(perm_domain_table) {
			group = find_group_in_domain_name_table(
					*perm_domain_table, _addr, (unsigned int)_port);
			LM_DBG("Found a match of domain_name in group <%d>\n", group);
		}
	}

	LM_DBG("Found <%d>\n", group);
	return group;
}

int allow_address_group(struct sip_msg *_msg, char *_addr, char *_port)
{
	int port;
	str ips;

	if(_addr == NULL || (fixup_get_svalue(_msg, (gparam_p)_addr, &ips) < 0)) {
		LM_ERR("cannot get value of address pvar\n");
		return -1;
	}
	if(_port == NULL || (fixup_get_ivalue(_msg, (gparam_p)_port, &port) < 0)) {
		LM_ERR("cannot get value of port pvar\n");
		return -1;
	}

	return ki_allow_address_group(_msg, &ips, port);
}
