/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */


#undef CONFIG_FTRACE_SYSCALLS

#include "ertp_handlers.h"

#include "ertp_ftrace_hook.h"
#include "ertp_handlers_close.h"
#include "ertp_handlers_execve.h"
#include "ertp_handlers_exit.h"
#include "ertp_handlers_mmap.h"
#include "ertp_handlers_module.h"
#include "ertp_handlers_open.h"
#include "ertp_handlers_rename.h"
#include "ertp_handlers_unlink.h"
#include "ertp_logs.h"

#define ERTP_HOOK(syscall_name, type, handler_func, original_func_ptr)         \
  {                                                                            \
    .name = (syscall_name), .syscall_type = (type), .handler = (handler_func), \
    .original = (original_func_ptr)                                            \
  }

#define ERTP_SYSCALL64_PREFIX "__x64_sys_"

static struct ertp_ftrace_hook ertp_ftrace_hooks[] = {
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "open", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_open, &ertp_original_native_64_open),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "openat", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_openat, &ertp_original_native_64_openat),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "close", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_close, &ertp_original_native_64_close),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "dup2", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_dup2, &ertp_original_native_64_dup2),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "dup3", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_dup3, &ertp_original_native_64_dup3),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "exit", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_exit, &ertp_original_native_64_exit),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "exit_group", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_exit_group,
              &ertp_original_native_64_exit_group),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "execve", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_execve, &ertp_original_native_64_execve),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "execveat", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_execveat,
              &ertp_original_native_64_execveat),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "finit_module", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_finit_module,
              &ertp_original_native_64_finit_module),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "init_module", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_init_module,
              &ertp_original_native_64_init_module),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "mmap", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_mmap, &ertp_original_native_64_mmap),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "rename", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_rename, &ertp_original_native_64_rename),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "renameat", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_renameat,
              &ertp_original_native_64_renameat),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "renameat2", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_renameat2,
              &ertp_original_native_64_renameat2),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "unlink", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_unlink, &ertp_original_native_64_unlink),
    ERTP_HOOK(ERTP_SYSCALL64_PREFIX "unlinkat", ERTP_SYSCALL_TYPE_NATIVE_64,
              ertp_handler_native_64_unlinkat,
              &ertp_original_native_64_unlinkat),

#ifdef CONFIG_COMPAT

    ERTP_HOOK("open", ERTP_SYSCALL_TYPE_COMPAT_32, ertp_handler_compat_32_open,
              &ertp_original_compat_32_open),
    ERTP_HOOK("openat", ERTP_SYSCALL_TYPE_COMPAT_32,
              ertp_handler_compat_32_openat, &ertp_original_compat_32_openat),

    ERTP_HOOK("execve", ERTP_SYSCALL_TYPE_COMPAT_32,
              ertp_handler_compat_32_execve, &ertp_original_compat_32_execve),
    ERTP_HOOK("execveat", ERTP_SYSCALL_TYPE_COMPAT_32,
              ertp_handler_compat_32_execveat,
              &ertp_original_compat_32_execveat),
    ERTP_HOOK("open", ERTP_SYSCALL_TYPE_NATIVE_32, ertp_handler_native_32_open,
              &ertp_original_native_32_open),
    ERTP_HOOK("openat", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_openat, &ertp_original_native_32_openat),
    ERTP_HOOK("close", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_close, &ertp_original_native_32_close),
    ERTP_HOOK("dup2", ERTP_SYSCALL_TYPE_NATIVE_32, ertp_handler_native_32_dup2,
              &ertp_original_native_32_dup2),
    ERTP_HOOK("dup3", ERTP_SYSCALL_TYPE_NATIVE_32, ertp_handler_native_32_dup3,
              &ertp_original_native_32_dup3),
    ERTP_HOOK("exit", ERTP_SYSCALL_TYPE_NATIVE_32, ertp_handler_native_32_exit,
              &ertp_original_native_32_exit),
    ERTP_HOOK("exit_group", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_exit_group,
              &ertp_original_native_32_exit_group),
    ERTP_HOOK("execve", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_execve, &ertp_original_native_32_execve),
    ERTP_HOOK("execveat", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_execveat,
              &ertp_original_native_32_execveat),
    ERTP_HOOK("finit_module", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_finit_module,
              &ertp_original_native_32_finit_module),
    ERTP_HOOK("init_module", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_init_module,
              &ertp_original_native_32_init_module),

    ERTP_HOOK("rename", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_rename, &ertp_original_native_32_rename),
    ERTP_HOOK("renameat", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_renameat,
              &ertp_original_native_32_renameat),
    ERTP_HOOK("renameat2", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_renameat2,
              &ertp_original_native_32_renameat2),
    ERTP_HOOK("unlink", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_unlink, &ertp_original_native_32_unlink),
    ERTP_HOOK("unlinkat", ERTP_SYSCALL_TYPE_NATIVE_32,
              ertp_handler_native_32_unlinkat,
              &ertp_original_native_32_unlinkat),
#endif
};

int ertp_handlers_init(void) {
  int err;
  size_t init_hook_no, deinit_hook_no;

  for (init_hook_no = 0; init_hook_no < ARRAY_SIZE(ertp_ftrace_hooks);
       init_hook_no++) {
    err = ertp_ftrace_hook_register(&ertp_ftrace_hooks[init_hook_no]);
    if (err) {
      goto error;
    }
  }

  ertp_pr_info("registered syscall handlers");

  return 0;

error:
  for (deinit_hook_no = 0; deinit_hook_no < init_hook_no; deinit_hook_no++) {
    ertp_ftrace_hook_unregister(&ertp_ftrace_hooks[deinit_hook_no]);
  }

  return err;
}

void ertp_handlers_deinit(void) {
  size_t hook_no;
  for (hook_no = 0; hook_no < ARRAY_SIZE(ertp_ftrace_hooks); hook_no++) {
    ertp_ftrace_hook_unregister(&ertp_ftrace_hooks[hook_no]);
  }
  ertp_pr_info("unregistered syscall handlers");
}