/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include "ertp_event.h"

#include <linux/cred.h>
#include <linux/mnt_namespace.h>
#include <linux/nsproxy.h>
#include <linux/slab.h>
#include <linux/version.h>

#include "ertp.h"
#include "ertp_cache.h"
#include "ertp_logs.h"

#if (LINUX_VERSION_CODE > KERNEL_VERSION(5, 17, 0))
#include <linux/magic.h>
#endif

#ifndef FUSE_SUPER_MAGIC
#define FUSE_SUPER_MAGIC 0x65735546
#endif

#define ERTP_EVENT_RESULT_NOT_SET 0x80000000

#define ERTP_FD_PATH_STR_SIZE 128
#define ERTP_ID_STR_SIZE 32

static int get_unused_fd(void) { return get_unused_fd_flags(0); }

static atomic_t ertp_event_ids = ATOMIC_INIT(0);

static struct mnt_namespace *global_mnt_ns = NULL;

static struct kmem_cache *ertp_event_generic_allocator = NULL;
static struct kmem_cache *ertp_event_memory_allocator = NULL;
static struct kmem_cache *ertp_event_remove_allocator = NULL;

static int ertp_event_allocator_init(void) {
  ertp_event_generic_allocator = kmem_cache_create(
      "ertp_event_generic_allocator", sizeof(struct ertp_event_generic),
      __alignof__(struct ertp_event_generic), SLAB_RECLAIM_ACCOUNT, NULL);

  ertp_event_memory_allocator = kmem_cache_create(
      "ertp_event_memory_allocator", sizeof(struct ertp_event_memory),
      __alignof__(struct ertp_event_memory), SLAB_RECLAIM_ACCOUNT, NULL);

  ertp_event_remove_allocator = kmem_cache_create(
      "ertp_event_remove_allocator", sizeof(struct ertp_event_remove),
      __alignof__(struct ertp_event_remove), SLAB_RECLAIM_ACCOUNT, NULL);

  if (!ertp_event_generic_allocator || !ertp_event_memory_allocator ||
      !ertp_event_remove_allocator) {
    return -ENOMEM;
  }

  return 0;
}

static void ertp_event_allocator_deinit(void) {
  if (ertp_event_generic_allocator) {
    kmem_cache_destroy(ertp_event_generic_allocator);
  }
  if (ertp_event_memory_allocator) {
    kmem_cache_destroy(ertp_event_memory_allocator);
  }
  if (ertp_event_remove_allocator) {
    kmem_cache_destroy(ertp_event_remove_allocator);
  }
}

int ertp_event_init(void) {
  int err = 0;
  if (current->nsproxy) {
    global_mnt_ns = current->nsproxy->mnt_ns;
  }
  if (!global_mnt_ns) {
    ertp_pr_error("could not determine global mount namespace");
  }

  err = ertp_path_init();
  if (err) {
    return err;
  }

  return ertp_event_allocator_init();
}

void ertp_event_deinit(void) {
  ertp_event_allocator_deinit();
  ertp_path_deinit();
}

static bool is_current_process_in_global_mnt_namespace(void) {
  if (current->nsproxy && global_mnt_ns) {
    return current->nsproxy->mnt_ns == global_mnt_ns;
  }

  return true;
}

struct ertp_event *ertp_event_ref(struct ertp_event *event) {
  if (!event || IS_ERR(event)) return NULL;

  BUG_ON(atomic_read(&event->count) == 0);
  atomic_inc(&event->count);

  return event;
}

void ertp_event_unref(struct ertp_event *event) {
  if (!event || IS_ERR(event)) return;

  BUG_ON(atomic_read(&event->count) == 0);

  if (!atomic_dec_and_test(&event->count)) return;

  event->destroy(event);
}

int ertp_event_get_result(struct ertp_event *event) {
  int result;
  spin_lock(&event->result_lock);
  result = event->result;
  spin_unlock(&event->result_lock);
  return result;
}

void ertp_event_disable_context(struct ertp_event *event) {
  event->save_context = false;
}

const char *ertp_event_type_to_str(enum ertp_event_type type) {
  switch (type) {
    case ERTP_EVENT_TYPE_OPEN:
      return "OPEN";
    case ERTP_EVENT_TYPE_CLOSE:
      return "CLOSE";
    case ERTP_EVENT_TYPE_EXEC:
      return "EXEC";
  }
  return "(unknown)";
}

const char *ertp_event_class_to_str(enum ertp_event_class class) {
  switch (class) {
    case ERTP_EVENT_CLASS_GENERIC:
      return "GENERIC";
    case ERTP_EVENT_CLASS_MEMORY:
      return "MEMORY";
    case ERTP_EVENT_CLASS_REMOVE:
      return "REMOVE";
  }
  return "(unknown)";
}

void ertp_event_finished(struct ertp_event *event_base, int result) {
  ertp_pr_edlog("Event finished and unblocked (id: %d, result: %d)",
                event_base->id, result);

  spin_lock(&event_base->result_lock);
  event_base->result = result;
  spin_unlock(&event_base->result_lock);

  complete_all(&event_base->wait_scanner);
}

void ertp_event_unblock(struct ertp_event *event_base, int result) {
  ertp_pr_edlog("Event unblocked (id: %d, result: %d)", event_base->id, result);

  spin_lock(&event_base->result_lock);
  if (event_base->result == ERTP_EVENT_RESULT_NOT_SET) {
    event_base->result = result;
  }
  spin_unlock(&event_base->result_lock);

  complete_all(&event_base->wait_scanner);
}

static int ertp_open_event_dev_file(struct ertp_event_memory *event) {
  struct file *file;
  int flags;
  int fd;
  char str_path[ERTP_FD_PATH_STR_SIZE];

  fd = get_unused_fd();
  if (fd < 0) {
    return fd;
  }

  flags = O_RDONLY;
  flags |= event->flags & O_LARGEFILE;

  str_path[0] = '\0';
  strlcat(str_path, "/dev/", ERTP_FD_PATH_STR_SIZE);
  strlcat(str_path, event->dev_info->name, ERTP_FD_PATH_STR_SIZE);

  file = filp_open(str_path, flags, 0);

  if (!file || IS_ERR(file)) {
    ertp_pr_edlog("cannot open mem_dev file for event %d with path %s",
                  event->base.id, str_path);
    put_unused_fd(fd);
    return 1;
  }

  event->file = file;
  event->fd = fd;

  return 0;
}

static void ertp_event_flex_buffer_clear(
    struct ertp_event_flex_buffer *buffer) {
  buffer->data = NULL;
  buffer->size = 0;
}

void ertp_event_flex_buffer_init(struct ertp_event_flex_buffer *buffer) {
  ertp_event_flex_buffer_clear(buffer);
}

void ertp_event_flex_buffer_deinit(struct ertp_event_flex_buffer *buffer) {
  kfree(buffer->data);
  ertp_event_flex_buffer_clear(buffer);
}

static int ertp_event_flex_buffer_alloc(struct ertp_event_flex_buffer *buffer,
                                        size_t size) {
  void *buf = kzalloc(size, GFP_KERNEL);
  if (unlikely(!buf)) {
    return -ENOMEM;
  }

  if (buffer->data) {
    BUG();
  }

  buffer->data = buf;
  buffer->size = size;
  return 0;
}

bool ertp_event_flex_buffer_empty(struct ertp_event_flex_buffer *buffer) {
  return buffer->data == NULL || buffer->size == 0;
}

static void ertp_path_serialize(const struct ertp_path *path,
                                struct eset_rtp_flexible_member *flex,
                                struct ertp_event_flex_buffer *buffer,
                                size_t *offset) {
  size_t off = *offset;

  if (unlikely(!path->ptr)) {
    BUG();
  }

  if (unlikely(off >= buffer->size)) {
    BUG();
  }

  if (unlikely(path->size > buffer->size - off)) {
    BUG();
  }

  memcpy(buffer->data + off, path->ptr, path->size);
  flex->offset = (uint32_t)off;
  flex->size = (uint32_t)path->size;

  *offset = off + path->size;
}

static size_t ertp_event_generic_flex_members_size(
    const struct ertp_event *event_base) {
  struct ertp_event_generic *event = ERTP_EVENT_GENERIC(event_base);
  return event->file_path->size + event->process_path->size;
}

static int ertp_event_generic_serialize(
    struct ertp_event *event_base, struct eset_rtp_event *buf,
    struct ertp_event_flex_buffer *flex_buffer) {
  int err = 0;
  struct ertp_event_generic *event = ERTP_EVENT_GENERIC(event_base);
  struct eset_rtp_event_generic *event_buffer = &buf->data.generic;
  size_t offset = 0;
  int fd;

  ertp_pr_edlog(
      "GENERIC event serialize (id: %d, type: %s, prio: %s, deadline: %s [%s])",
      event_base->id, ertp_event_type_to_str(event->type),
      ertp_qos_event_data_debug_get_prio_str(&event_base->qos_data),
      ertp_qos_event_data_is_after_deadline(&event_base->qos_data) ? "yes"
                                                                   : "no",
      ertp_qos_event_data_debug_get_type_str(&event_base->qos_data));

  switch (event->type) {
    case ERTP_EVENT_TYPE_OPEN:
      buf->type = ERTP_TYPE_OPEN_EVENT;
      break;

    case ERTP_EVENT_TYPE_CLOSE:
      buf->type = ERTP_TYPE_CLOSE_EVENT;
      break;

    case ERTP_EVENT_TYPE_EXEC:
      buf->type = ERTP_TYPE_EXEC_EVENT;
      break;

    default:
      BUG();
  }

  err = ertp_event_flex_buffer_alloc(
      flex_buffer, ertp_event_generic_flex_members_size(event_base));
  if (err) {
    ertp_pr_edlog("cannot alloc flex buffer for event %d with path %s",
                  event->base.id, event->file_path->ptr);
    goto error;
  }

  ertp_path_serialize(event->file_path, &event_buffer->file_path, flex_buffer,
                      &offset);
  ertp_path_serialize(event->process_path, &event_buffer->process_path,
                      flex_buffer, &offset);

  fd = get_unused_fd();
  if (fd < 0) {
    ertp_pr_edlog(
        "cannot install file descriptor into user space for event %d with path "
        "%s",
        event->base.id, event->file_path->ptr);
    goto error;
  }

  fd_install(fd, event->file);
  event->file = NULL;

  buf->data.generic.id = event_base->id;
  buf->data.generic.fd = fd;
  buf->data.generic.pid = event->pid;
  buf->data.generic.uid = event->uid.val;
  buf->data.generic.gid = event->gid.val;
  buf->data.generic.file_id = event->ino;
  buf->data.generic.device_number = event->dev;
  buf->data.generic.under_fuse = event->under_fuse;
  buf->data.generic.mnt_namespace = event->mnt_namespace;
  buf->data.generic.file_size = event->file_size;
  buf->data.generic.ctime.tv_sec = event->ctime.tv_sec;
  buf->data.generic.ctime.tv_nsec = event->ctime.tv_nsec;
  buf->data.generic.mtime.tv_sec = event->mtime.tv_sec;
  buf->data.generic.mtime.tv_nsec = event->mtime.tv_nsec;
  buf->data.generic.mode = event->mode;
  buf->data.generic.flags = event->modified ? ERTP_EVENT_FLAG_MODIFIED : 0;

  return 0;

error:
  return err;
}

static size_t ertp_event_memory_flex_members_size(
    const struct ertp_event *event_base) {
  struct ertp_event_memory *event = ERTP_EVENT_MEMORY(event_base);
  return event->process_path->size;
}

static int ertp_event_memory_serialize(
    struct ertp_event *event_base, struct eset_rtp_event *buf,
    struct ertp_event_flex_buffer *flex_buffer) {
  int err = 0;
  struct ertp_event_memory *event = ERTP_EVENT_MEMORY(event_base);
  struct eset_rtp_event_memory *event_buffer = &buf->data.memory;
  size_t offset = 0;

  ertp_pr_edlog(
      "MEMORY event serialize (id: %d, type: %s, prio: %s, deadline: %s [%s])",
      event_base->id, ertp_event_type_to_str(event->type),
      ertp_qos_event_data_debug_get_prio_str(&event_base->qos_data),
      ertp_qos_event_data_is_after_deadline(&event_base->qos_data) ? "yes"
                                                                   : "no",
      ertp_qos_event_data_debug_get_type_str(&event_base->qos_data));

  switch (event->type) {
    case ERTP_EVENT_TYPE_EXEC:
      buf->type = ERTP_TYPE_MEMORY_EXEC_EVENT;
      break;
    default:
      BUG();
  }

  err = ertp_event_flex_buffer_alloc(
      flex_buffer, ertp_event_memory_flex_members_size(event_base));
  if (err) {
    goto error;
  }

  ertp_path_serialize(event->process_path, &event_buffer->process_path,
                      flex_buffer, &offset);

  err = ertp_open_event_dev_file(event);
  if (unlikely(err)) {
    ertp_pr_edlog("cannot open mem file for event (id: %d, errno: %d)",
                  event_base->id, err);
    goto error;
  }

  fd_install(event->fd, event->file);

  buf->data.memory.id = event_base->id;
  buf->data.memory.fd = event->fd;
  buf->data.memory.pid = event->pid;
  buf->data.memory.uid = event->uid.val;
  buf->data.memory.gid = event->gid.val;
  buf->data.memory.file_size = event->size;

  return 0;

error:
  return err;
}

static size_t ertp_event_remove_flex_members_size(
    const struct ertp_event *event_base) {
  return 0;
}

static int ertp_event_remove_serialize(
    struct ertp_event *event_base, struct eset_rtp_event *buf,
    struct ertp_event_flex_buffer *flex_buffer) {
  struct ertp_event_remove *event = ERTP_EVENT_REMOVE(event_base);

  ertp_pr_edlog("REMOVE event serialize (id: %d, prio: %s, deadline: %s [%s])",
                event_base->id,
                ertp_qos_event_data_debug_get_prio_str(&event_base->qos_data),
                ertp_qos_event_data_is_after_deadline(&event_base->qos_data)
                    ? "yes"
                    : "no",
                ertp_qos_event_data_debug_get_type_str(&event_base->qos_data));

  buf->type = ERTP_TYPE_REMOVE_EVENT;
  buf->data.remove.id = event_base->id;
  buf->data.remove.file_id = event->ino;
  buf->data.remove.device_number = event->dev;
  return 0;
}

static void ertp_event_generic_free(struct ertp_event *event_base) {
  struct ertp_event_generic *event = ERTP_EVENT_GENERIC(event_base);

  path_put(&event->path);
  ertp_path_unref(event->file_path);
  ertp_path_unref(event->process_path);

  if (event->file) {
    fput(event->file);
  }

  kmem_cache_free(ertp_event_generic_allocator, event);
}

static void ertp_event_memory_free(struct ertp_event *event_base) {
  struct ertp_event_memory *event = ERTP_EVENT_MEMORY(event_base);
  ertp_path_unref(event->process_path);

  kmem_cache_free(ertp_event_memory_allocator, event);
}

static void ertp_event_remove_free(struct ertp_event *event_base) {
  struct ertp_event_remove *event = ERTP_EVENT_REMOVE(event_base);
  kmem_cache_free(ertp_event_remove_allocator, event);
}

static inline void ertp_event_base_init(struct ertp_event *event) {
  ertp_heap_node_init(&event->node);
  atomic_set(&event->count, 1);
  event->id = atomic_inc_return(&ertp_event_ids);
  init_completion(&event->wait_qos);
  init_completion(&event->wait_scanner);
  event->result = ERTP_EVENT_RESULT_NOT_SET;
  spin_lock_init(&event->result_lock);
  event->save_context = true;

  ertp_event_stats_init(&event->stats);

  if (unlikely(!event->destroy || !event->serialize ||
               !event->flex_members_size)) {
    BUG();
  }
}

static inline enum ertp_qos_event_type get_qos_type_for_generic_event(
    enum ertp_event_type type, unsigned int flags) {
  if (type == ERTP_EVENT_TYPE_EXEC) {
    return ERTP_QOS_EVENT_TYPE_READ;
  }

  return ((flags & O_ACCMODE) == O_RDONLY) ? ERTP_QOS_EVENT_TYPE_READ
                                           : ERTP_QOS_EVENT_TYPE_WRITE;
}

static struct file *open_file_for_scanner(const struct file *file,
                                          const char *path) {
  struct file *file_for_scanner;
  int flags;

  flags = O_RDONLY;
  flags |= file->f_flags & O_LARGEFILE;

  file_for_scanner = ertp_dentry_open(&file->f_path, flags);
  if (IS_ERR(file_for_scanner) && !d_unlinked(file->f_path.dentry)) {
    file_for_scanner = filp_open(path, flags, 0);
  }

  return file_for_scanner;
}

struct ertp_event *ertp_event_generic_new(
    const struct ertp_event_generic_info *params) {
  struct file *file = NULL;
  int ret_val = -ENODATA;
  struct ertp_event *event_base;
  struct ertp_event_generic *event =
      kmem_cache_zalloc(ertp_event_generic_allocator, GFP_KERNEL);
  if (unlikely(!event)) {
    return ERR_PTR(-ENOMEM);
  }

  if (unlikely(params->signal_handler == ERTP_SIGNAL_HANDLER_UNINITIALIZED)) {
    ertp_pr_error("signal handler is not initialized");
    BUG();
  }

  if (unlikely(!ertp_get_inode(params->file))) {
    ertp_pr_edlog("cannot create generic event for file %s: inode not found",
                  params->file_path->ptr);
    goto error;
  }

  file = open_file_for_scanner(params->file, params->file_path->ptr);
  if (unlikely(IS_ERR(file))) {
    ertp_pr_edlog(
        "cannot create generic event for file %s: file opening failed with "
        "error %ld)",
        params->file_path->ptr, PTR_ERR(file));
    ret_val = PTR_ERR(file);
    goto error;
  }

  event_base = ERTP_EVENT(event);
  event_base->class = ERTP_EVENT_CLASS_GENERIC;
  event_base->qos_data.type =
      get_qos_type_for_generic_event(params->type, params->file->f_flags);
  event_base->destroy = &ertp_event_generic_free;
  event_base->serialize = &ertp_event_generic_serialize;
  event_base->flex_members_size = &ertp_event_generic_flex_members_size;
  event_base->signal_handler = params->signal_handler;
  ertp_event_base_init(event_base);

  event->type = params->type;
  event->modified = params->modified;
  event->file = file;

  path_get(&params->file->f_path);
  event->path = params->file->f_path;
  event->under_fuse = (ertp_get_sb_magic(params->file) == FUSE_SUPER_MAGIC);
  event->file_path = ertp_path_ref(params->file_path);

  current_uid_gid(&event->uid, &event->gid);
  event->pid = current->tgid;
  event->process_path = ertp_path_ref(params->process_path);
  event->mnt_namespace = !is_current_process_in_global_mnt_namespace();

  event->ino = params->attr_info.ino;
  event->dev = new_encode_dev(params->attr_info.dev);
  event->file_size = params->attr_info.size;
  event->ctime = params->attr_info.ctime;
  event->mtime = params->attr_info.mtime;
  event->mode = params->attr_info.mode;

  ertp_pr_edlog(
      "GENERIC event created (id: %d, type: %s, ino: %lld, dev: %lld, size: "
      "%llub, fuse: %d, mnt_ns: %d, file: %s, process: %s)",
      event_base->id, ertp_event_type_to_str(event->type), event->ino,
      event->dev, event->file_size, event->under_fuse, event->mnt_namespace,
      event->file_path->ptr, event->process_path->ptr);

  return event_base;

error:

  kmem_cache_free(ertp_event_generic_allocator, event);
  return ERR_PTR(ret_val);
}

struct ertp_event *ertp_event_memory_new(
    const struct ertp_event_memory_info *params, unsigned int timeout) {
  struct ertp_event *event_base;
  struct ertp_event_memory *event;
  char id_str[ERTP_ID_STR_SIZE];
  int ret_val = -ENODATA;

  event = kmem_cache_zalloc(ertp_event_memory_allocator, GFP_KERNEL);
  if (unlikely(!event)) {
    return ERR_PTR(-ENOMEM);
  }

  if (unlikely(params->signal_handler == ERTP_SIGNAL_HANDLER_UNINITIALIZED)) {
    ertp_pr_error("signal handler is not initialized");
    BUG();
  }

  event_base = ERTP_EVENT(event);
  event_base->class = ERTP_EVENT_CLASS_MEMORY;
  event_base->qos_data.type = ERTP_QOS_EVENT_TYPE_READ;
  event_base->destroy = &ertp_event_memory_free;
  event_base->serialize = &ertp_event_memory_serialize;
  event_base->flex_members_size = &ertp_event_memory_flex_members_size;
  event_base->signal_handler = params->signal_handler;
  ertp_event_base_init(event_base);

  snprintf(id_str, ERTP_ID_STR_SIZE, "%d", event_base->id);
  ret_val = ertp_mem_dev_create(id_str, event, timeout);
  if (ret_val) {
    goto error;
  }

  event->type = params->type;
  current_uid_gid(&event->uid, &event->gid);
  event->pid = current->tgid;
  event->process_path = ertp_path_ref(params->process_path);
  event->size = params->size;
  event->memory = params->memory_to_scan;

  ertp_pr_edlog(
      "MEMORY event created (id: %d, type: %s, size: %lu, mem_dev file: %s, "
      "process: %s)",
      event_base->id, ertp_event_type_to_str(event->type), event->size,
      event->dev_info->name, event->process_path->ptr);

  return event_base;

error:
  kmem_cache_free(ertp_event_memory_allocator, event);
  return ERR_PTR(ret_val);
}

struct ertp_event *ertp_event_remove_new(
    const struct ertp_event_remove_info *params) {
  struct ertp_event *event_base;
  struct ertp_event_remove *event;
  struct kstat stat;
  int ret_attr;

  if (unlikely(!params->path)) {
    ertp_pr_edlog("cannot create remove event: invalid path");
    return ERR_PTR(-EINVAL);
  }

  if (unlikely(params->signal_handler == ERTP_SIGNAL_HANDLER_UNINITIALIZED)) {
    ertp_pr_error("signal handler is not initialized");
    BUG();
  }

  ret_attr = vfs_getattr_nosec(params->path, &stat, STATX_BASIC_STATS, 0);
  if (ret_attr != 0) {
    ertp_pr_edlog("cannot create remove event: getattr failed with error %d",
                  ret_attr);
    return ERR_PTR(ret_attr);
  }

  event = kmem_cache_zalloc(ertp_event_remove_allocator, GFP_KERNEL);
  if (!event) {
    return ERR_PTR(-ENOMEM);
  }

  event_base = ERTP_EVENT(event);
  event_base->class = ERTP_EVENT_CLASS_REMOVE;
  event_base->qos_data.type = ERTP_QOS_EVENT_TYPE_WRITE;
  event_base->destroy = &ertp_event_remove_free;
  event_base->serialize = &ertp_event_remove_serialize;
  event_base->flex_members_size = &ertp_event_remove_flex_members_size;
  event_base->signal_handler = params->signal_handler;
  ertp_event_base_init(event_base);

  event->ino = stat.ino;
  event->dev = new_encode_dev(stat.dev);

  ertp_pr_edlog(
      "REMOVE event created (id: %d, ino: %llu, dev: %llu, file: %s, process: "
      "%s)",
      event_base->id, event->ino, event->dev, params->file_path->ptr,
      params->process_path->ptr);

  return event_base;
}