/*
 * eset_wap (ESET Web Access Protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include "ewap_probes.h"

#include <asm/current.h>
#include <linux/compiler.h>
#include <linux/cred.h>
#include <net/tcp.h>

#include "ewap_connect_data.h"
#include "ewap_ftrace.h"
#include "ewap_helpers.h"
#include "ewap_tracepoints.h"

static int (*tcp_v4_connect_original)(struct sock *sk, struct sockaddr *uaddr,
                                      int addr_len);

static int tcp_v4_connect_handler(struct sock *sk, struct sockaddr *uaddr,
                                  int addr_len) {
  int original_call_ret;
  int ret;

  ewap_pr_log(EWAP_LOG_HOOKS, "tcp_v4_connect_handler hit from pid: %d",
              current->tgid);

  original_call_ret = tcp_v4_connect_original(sk, uaddr, addr_len);
  if (original_call_ret != 0) {
    ewap_pr_log(EWAP_LOG_HOOKS,
                "not processing unsuccessful original connect (%d)",
                original_call_ret);
    goto end;
  }

  ret = ewap_connect_data_save_connection(sk, current->tgid, current_uid().val);
  if (unlikely(!ret)) {
    ewap_pr_log(EWAP_LOG_HOOKS, "ignoring unknown family %d", sk->sk_family);
  }

end:
  return original_call_ret;
}

static struct ewap_ftrace_hook v4_connect_ftrace_hook = {
    .name = "tcp_v4_connect",
    .original = &tcp_v4_connect_original,
    .handler = &tcp_v4_connect_handler};

static int (*tcp_v6_connect_original)(struct sock *sk, struct sockaddr *uaddr,
                                      int addr_len);

static int tcp_v6_connect_handler(struct sock *sk, struct sockaddr *uaddr,
                                  int addr_len) {
  int original_call_ret;
  int ret;

  ewap_pr_log(EWAP_LOG_HOOKS, "tcp_v6_connect_handler hit from pid: %d",
              current->tgid);

  original_call_ret = tcp_v6_connect_original(sk, uaddr, addr_len);
  if (original_call_ret != 0) {
    ewap_pr_log(EWAP_LOG_HOOKS,
                "not processing unsuccessful original connect (%d)",
                original_call_ret);
    goto end;
  }

  ret = ewap_connect_data_save_connection(sk, current->tgid, current_uid().val);
  if (unlikely(!ret)) {
    ewap_pr_log(EWAP_LOG_HOOKS, "ignoring unknown family %d", sk->sk_family);
  }

end:
  return original_call_ret;
}

static struct ewap_ftrace_hook v6_connect_ftrace_hook = {
    .name = "tcp_v6_connect",
    .original = &tcp_v6_connect_original,
    .handler = &tcp_v6_connect_handler};

static void (*tcp_set_state_original)(struct sock *sk, int state);

static void tcp_set_state_handler(struct sock *sk, int state) {
  int ret;

  ewap_pr_log(EWAP_LOG_HOOKS, "tcp_set_state_handler hit, from pid: %d",
              current->tgid);

  if (state == TCP_CLOSE) {
    ret = ewap_connect_data_erase_connection(sk);
    if (unlikely(!ret)) {
      ewap_pr_log(EWAP_LOG_HOOKS, "ignoring unknown family %d", sk->sk_family);
    }

  } else {
    ewap_pr_log(EWAP_LOG_HOOKS,
                "ignoring processing of non-close tcp_set_state: %d", state);
  }

  tcp_set_state_original(sk, state);
}

static struct ewap_ftrace_hook set_state_ftrace_hook = {
    .name = "tcp_set_state",
    .original = &tcp_set_state_original,
    .handler = &tcp_set_state_handler};

static void probe_sched_process_exit(void *data, struct task_struct *task) {
  ewap_pr_log(EWAP_LOG_HOOKS,
              "sched_process_exit probe called (tgid: %d, pid: %d)", task->tgid,
              task->pid);

  if (task->tgid == task->pid) {
    ewap_connect_data_erase_all_connections(task->tgid);
  }
}

static struct ewap_tracepoint sched_process_exit_hook = {
    .name = "sched_process_exit",
    .handler = &probe_sched_process_exit,
};

int ewap_probes_init(void) {
  int ret = 0;

  if ((ret = ewap_ftrace_register(&v4_connect_ftrace_hook))) {
    ewap_pr_log(EWAP_LOG_ERRORS,
                "v4_connect_ftrace_hook probe register failed: %d", ret);
    goto err_v4_connect_ftrace_hook;
  }

  if ((ret = ewap_ftrace_register(&v6_connect_ftrace_hook))) {
    ewap_pr_log(EWAP_LOG_ERRORS,
                "v6_connect_ftrace_hook probe register failed: %d", ret);
    goto err_v6_connect_ftrace_hook;
  }

  if ((ret = ewap_ftrace_register(&set_state_ftrace_hook))) {
    ewap_pr_log(EWAP_LOG_ERRORS,
                "set_state_ftrace_hook probe register failed: %d", ret);
    goto err_set_state_ftrace_hook;
  }

  if ((ret = ewap_tracepoint_register(&sched_process_exit_hook))) {
    ewap_pr_log(EWAP_LOG_ERRORS,
                "probe_sched_process_exit tracepoint register failed: %d", ret);
    goto err_probe_sched_process_exit;
  }

  ewap_pr_log(EWAP_LOG_HOOKS, "all probes initialized");

  return 0;

err_probe_sched_process_exit:
  ewap_ftrace_unregister(&set_state_ftrace_hook);
err_set_state_ftrace_hook:
  ewap_ftrace_unregister(&v6_connect_ftrace_hook);
err_v6_connect_ftrace_hook:
  ewap_ftrace_unregister(&v4_connect_ftrace_hook);
err_v4_connect_ftrace_hook:
  return ret;
}

void ewap_probes_deinit(void) {
  ewap_ftrace_unregister(&set_state_ftrace_hook);
  ewap_ftrace_unregister(&v6_connect_ftrace_hook);
  ewap_ftrace_unregister(&v4_connect_ftrace_hook);
  ewap_tracepoint_unregister(&sched_process_exit_hook);
  tracepoint_synchronize_unregister();

  ewap_pr_log(EWAP_LOG_HOOKS, "probes deinitialized");
}