/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include "ertp_event_check.h"

#include <linux/fdtable.h>
#include <linux/magic.h>
#include <linux/stat.h>

#include "ertp.h"
#include "ertp_cache.h"
#include "ertp_excludes.h"
#include "ertp_qos.h"

bool ertp_check_interrupted_by_signal(int rv) {
  return ((rv == -ERESTARTSYS) || (rv == -ERESTARTNOINTR));
}

static inline int ertp_convert_errno_to_syscall_exit_code(int errno) {
  switch (errno) {
    case -EPERM:
    case -ENOMEM:
    case -ERESTARTSYS:
    case -ERESTARTNOINTR:
      return errno;
  }

  return 0;
}

enum ertp_check_event_info_result {
  ERTP_CHECK_CONTINUE,
  ERTP_CHECK_DENY,
  ERTP_CHECK_SCAN,
  ERTP_CHECK_FORCE_SCAN
};

static bool ertp_scanner_ready(void) {
  if (unlikely(ertp_qos_scanner_check_thread())) return false;

  if (!ertp_qos_enabled()) return false;

  return true;
}

static enum ertp_check_event_info_result ertp_check_file_info(
    struct ertp_event_generic_info *info) {
  int ret;
  if (!ertp_scanner_ready()) return ERTP_CHECK_CONTINUE;

  info->process_path = ertp_path_process_new();
  if (unlikely(IS_ERR(info->process_path))) {
    ertp_pr_edlog(
        "check file info failed: cannot obtain process path: (errno: %ld)",
        PTR_ERR(info->process_path));
    return ERTP_CHECK_DENY;
  }

  if (ertp_proc_excluded(info->process_path->ptr)) return ERTP_CHECK_CONTINUE;

  if (!ertp_get_inode(info->file)) return ERTP_CHECK_CONTINUE;

  if (!S_ISREG(ertp_get_inode(info->file)->i_mode)) return ERTP_CHECK_CONTINUE;

  ret = vfs_getattr_nosec(&info->file->f_path, &info->attr_info,
                          STATX_BASIC_STATS, 0);
  if (unlikely(ret < 0)) {
    ertp_pr_edlog(
        "check file info failed: getattr failed: (errno: %d, process: %s)", ret,
        info->process_path->ptr);
    return ERTP_CHECK_DENY;
  }

  if (info->attr_info.size == 0) return ERTP_CHECK_CONTINUE;

  if (info->type == ERTP_EVENT_TYPE_CLOSE &&
      ((info->file->f_flags & O_ACCMODE) == O_RDONLY))
    return ERTP_CHECK_CONTINUE;

#ifdef SECRETMEM_MAGIC
  if (ertp_get_sb_magic(info->file) == SECRETMEM_MAGIC)
    return ERTP_CHECK_CONTINUE;
#endif

  info->file_path = ertp_path_file_new(&info->file->f_path);
  if (unlikely(IS_ERR(info->file_path))) {
    ertp_pr_edlog(
        "check file info failed: cannot obtain file path: (errno: %ld, "
        "process: %s)",
        PTR_ERR(info->file_path), info->process_path->ptr);
    return ERTP_CHECK_DENY;
  }

  if (ertp_file_excluded(info->file_path->ptr)) return ERTP_CHECK_CONTINUE;

  if (info->type == ERTP_EVENT_TYPE_CLOSE &&
      (((info->file->f_flags & O_ACCMODE) == O_WRONLY) ||
       ((info->file->f_flags & O_ACCMODE) == O_RDWR)))
    return ERTP_CHECK_FORCE_SCAN;

  return ERTP_CHECK_SCAN;
}

static int ertp_check_file(const struct ertp_check_context *context,
                           const struct file *file, enum ertp_event_type type) {
  int rv;
  struct ertp_event_generic_info event_info = {
      .file = file,
      .type = type,
      .modified = false,
      .file_path = NULL,
      .process_path = NULL,

      .signal_handler = context->signal_handler,
  };

  switch (ertp_check_file_info(&event_info)) {
    case ERTP_CHECK_CONTINUE:
      rv = 0;
      goto end;
    case ERTP_CHECK_DENY:
      rv = -EPERM;
      ertp_pr_edlog("event denied (type: GENERIC)");
      goto end;
    case ERTP_CHECK_SCAN:
      break;
    case ERTP_CHECK_FORCE_SCAN: {
      ertp_cache_remove(event_info.attr_info.ino,
                        new_encode_dev(event_info.attr_info.dev));
      event_info.modified = true;
      goto scan;
    }
  }

  switch (ertp_cache_check(&event_info)) {
    case ERTP_CACHE_FOUND:
      rv = 0;
      goto end;
    case ERTP_CACHE_MODIFIED:
      event_info.modified = true;
      break;
    case ERTP_CACHE_NOT_FOUND:
      break;
  }

scan:
  rv = ertp_qos_handle_generic_event(&event_info);

end:
  ertp_path_unref(event_info.file_path);
  ertp_path_unref(event_info.process_path);
  return ertp_convert_errno_to_syscall_exit_code(rv);
}

static enum ertp_check_event_info_result ertp_check_memory_info(
    struct ertp_event_memory_info *info) {
  if (!ertp_scanner_ready()) return ERTP_CHECK_CONTINUE;

  info->process_path = ertp_path_process_new();
  if (unlikely(IS_ERR(info->process_path))) return ERTP_CHECK_DENY;

  if (ertp_proc_excluded(info->process_path->ptr)) return ERTP_CHECK_CONTINUE;

  return ERTP_CHECK_SCAN;
}

static int ertp_check_memory(const struct ertp_check_context *context,
                             const unsigned char *memory, size_t size,
                             enum ertp_event_type type) {
  int rv;
  struct ertp_event_memory_info event_info = {
      .type = type,
      .process_path = NULL,
      .memory_to_scan = memory,
      .size = size,
      .signal_handler = context->signal_handler,
  };

  switch (ertp_check_memory_info(&event_info)) {
    case ERTP_CHECK_CONTINUE:
      rv = 0;
      goto end;
    case ERTP_CHECK_DENY:
      rv = -EPERM;
      ertp_pr_edlog("event denied (type: MEMORY)");
      goto end;
    case ERTP_CHECK_SCAN:
    case ERTP_CHECK_FORCE_SCAN:
      break;
  }

  rv = ertp_qos_handle_memory_event(&event_info);

end:
  ertp_path_unref(event_info.process_path);
  return ertp_convert_errno_to_syscall_exit_code(rv);
}

int ertp_check_open(const struct ertp_check_context *context,
                    const struct file *file) {
  return ertp_check_file(context, file, ERTP_EVENT_TYPE_OPEN);
}

int ertp_check_close(const struct ertp_check_context *context,
                     const struct file *file) {
  return ertp_check_file(context, file, ERTP_EVENT_TYPE_CLOSE);
}

int ertp_check_exec(const struct ertp_check_context *context,
                    const struct file *file) {
  return ertp_check_file(context, file, ERTP_EVENT_TYPE_EXEC);
}

int ertp_check_init_module(const struct ertp_check_context *context,
                           const unsigned char *memory, size_t size) {
  return ertp_check_memory(context, memory, size, ERTP_EVENT_TYPE_EXEC);
}

int ertp_check_all_open_files(
    const struct ertp_check_context *context,
    int (*file_check_fn)(const struct ertp_check_context *context,
                         const struct file *)) {
  unsigned fd, max_fds;
  int rv = 0;

  rcu_read_lock();
  max_fds = files_fdtable(current->files)->max_fds;
  rcu_read_unlock();

  for (fd = 0; fd < max_fds; fd++) {
    struct file *file = fget(fd);

    if (likely(file)) {
      int check_result = file_check_fn(context, file);
      fput(file);
      if (check_result != 0) {
        rv = check_result;
        if (ertp_check_interrupted_by_signal(rv)) {
          break;
        }
      }
    }
  }

  return ertp_convert_errno_to_syscall_exit_code(rv);
}

void ertp_check_remove(const struct ertp_check_context *context,
                       const struct ertp_path *file_path, struct path *path) {
  struct ertp_event_remove_info event_info = {
      .path = path,
      .process_path = NULL,
      .file_path = file_path,
      .signal_handler = context->signal_handler,
  };

  if (!ertp_scanner_ready()) goto end;

  if (likely(!IS_ERR(file_path)) &&
      ertp_file_excluded_by_default(file_path->ptr)) {
    goto end;
  }

  event_info.process_path = ertp_path_process_new();
  if (unlikely(IS_ERR(event_info.process_path))) goto end;

  if (ertp_proc_excluded_by_default(event_info.process_path->ptr)) goto end;

  ertp_qos_handle_remove_event(&event_info);

end:
  ertp_path_unref(event_info.process_path);
}