/*
 * Domain/Protocol Mapping Functions
 *
 * Author: Paul Moore <paul@paul-moore.com>
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>

#include <libnetlabel.h>

#include "netlabelctl.h"

/**
 * Add a domain mapping to NetLabel
 * @param argc the number of arguments
 * @param argv the argument list
 *
 * Add the specified domain mapping to the NetLabel system.  Returns zero on
 * success, negative values on failure.
 *
 */
static int map_add(int argc, char *argv[])
{
	uint32_t iter;
	uint8_t def_flag = 0;
	struct nlbl_dommap domain;
	struct nlbl_netaddr addr;
	char *domain_proto_extra = NULL;

	/* sanity checks */
	if (argc <= 0 || argv == NULL || argv[0] == NULL)
		return -EINVAL;

	memset(&domain, 0, sizeof(domain));
	memset(&addr, 0, sizeof(addr));

	/* parse the arguments */
	for (iter = 0; iter < argc && argv[iter] != NULL; iter++) {
		if (strncmp(argv[iter], "domain:", 7) == 0) {
			domain.domain = argv[iter] + 7;
		} else if (strncmp(argv[iter], "address:", 8) == 0) {
			if (nlctl_addr_parse(argv[iter] + 8, &addr) != 0)
				return -EINVAL;
		} else if (strncmp(argv[iter], "protocol:", 9) == 0) {
			/* protocol specifics */
			if (strncmp(argv[iter] + 9, "cipsov4", 7) == 0 ||
			    strncmp(argv[iter] + 9, "cipso", 5) == 0) {
				domain.proto_type = NETLBL_NLTYPE_CIPSOV4;
				domain.family = AF_INET;
			} else if (strncmp(argv[iter] + 9, "calipso", 7) == 0) {
				domain.proto_type = NETLBL_NLTYPE_CALIPSO;
				domain.family = AF_INET6;
			} else if (strncmp(argv[iter] + 9, "unlbl", 5) == 0) {
				domain.proto_type = NETLBL_NLTYPE_UNLABELED;
				domain.family = AF_UNSPEC;
			} else {
				return -EINVAL;
			}
			domain_proto_extra = strstr(argv[iter] + 9, ",");
			if (domain_proto_extra)
				domain_proto_extra++;
		} else if (strncmp(argv[iter], "default", 7) == 0) {
			def_flag = 1;
		} else
			return -EINVAL;
	}

	/* handle the protocol "extra" field */
	switch (domain.proto_type) {
	case NETLBL_NLTYPE_CIPSOV4:
		if (domain_proto_extra == NULL)
			return -EINVAL;
		domain.proto.cip_doi = atoi(domain_proto_extra);
		break;
	case NETLBL_NLTYPE_CALIPSO:
		if (domain_proto_extra == NULL)
			return -EINVAL;
		domain.proto.clp_doi = atoi(domain_proto_extra);
		break;
	case NETLBL_NLTYPE_UNLABELED:
		if (domain_proto_extra != NULL) {
			int family = atoi(domain_proto_extra);
			switch (family) {
			case 4:
				domain.family = AF_INET;
				break;
			case 6:
				domain.family = AF_INET6;
				break;
			default:
				return -EINVAL;
			}
		}
		break;
	}

	if (domain.family == AF_UNSPEC && addr.type != 0)
		domain.family = addr.type;

	/* add the mapping */
	if (def_flag != 0)
		return nlbl_mgmt_adddef(NULL, &domain, &addr);
	else
		return nlbl_mgmt_add(NULL, &domain, &addr);
}

/**
 * Delete a domain mapping from NetLabel
 * @param argc the number of arguments
 * @param argv the argument list
 *
 * Description:
 * Remove the specified domain mapping from the NetLabel system.  Returns zero
 * on success, negative values on failure.
 *
 */
static int map_del(int argc, char *argv[])
{
	uint32_t iter;
	uint32_t def_flag = 0;
	char *domain = NULL;

	/* sanity checks */
	if (argc <= 0 || argv == NULL || argv[0] == NULL)
		return -EINVAL;

	/* parse the arguments */
	for (iter = 0; iter < argc && argv[iter] != NULL; iter++) {
		if (strncmp(argv[iter], "domain:", 7) == 0) {
			domain = argv[iter] + 7;
		} else if (strncmp(argv[iter], "default", 7) == 0) {
			def_flag = 1;
		} else
			return -EINVAL;
	}

	/* remove the mapping */
	if (def_flag != 0)
		return nlbl_mgmt_deldef(NULL);
	else
		return nlbl_mgmt_del(NULL, domain);
}

/**
 * Output the NetLabel domain mappings
 * @param mapping the domain mappings
 * @param count the number of domain mappings
 *
 * Helper function to be called by map_list().  Note that we have preserved
 * the "CIPSOv4" so we don't break any scripts that may be in use.
 *
 */
static void map_list_print(struct nlbl_dommap *mapping, size_t count)
{
	uint32_t iter_a;
	struct nlbl_dommap_addr *iter_b;

	for (iter_a = 0; iter_a < count; iter_a++) {
		/* domain string */
		printf("domain:");
		if (mapping[iter_a].domain != NULL)
			printf("\"%s\",", mapping[iter_a].domain);
		else
			printf("DEFAULT,");
		/* protocol */
		switch (mapping[iter_a].proto_type) {
		case NETLBL_NLTYPE_UNLABELED:
			printf("UNLABELED");
			if (mapping[iter_a].family == AF_INET)
				printf(",4");
			else if (mapping[iter_a].family == AF_INET6)
				printf(",6");
			break;
		case NETLBL_NLTYPE_CIPSOV4:
			printf("CIPSOv4,%u", mapping[iter_a].proto.cip_doi);
			break;
		case NETLBL_NLTYPE_CALIPSO:
			printf("CALIPSO,%u", mapping[iter_a].proto.clp_doi);
			break;
		case NETLBL_NLTYPE_ADDRSELECT:
			iter_b = mapping[iter_a].proto.addrsel;
			while (iter_b) {
				printf("address:");
				nlctl_addr_print(&iter_b->addr);
				printf(",protocol:");
				switch (iter_b->proto_type) {
				case NETLBL_NLTYPE_UNLABELED:
					printf("UNLABELED");
					break;
				case NETLBL_NLTYPE_CIPSOV4:
					printf("CIPSOv4,%u",
					       iter_b->proto.cip_doi);
					break;
				case NETLBL_NLTYPE_CALIPSO:
					printf("CALIPSO,%u",
					       iter_b->proto.clp_doi);
					break;
				default:
					printf("UNKNOWN(%u)",
					       iter_b->proto_type);
					break;
				}
				iter_b = iter_b->next;
				if (iter_b)
					printf(",");
			}
			break;
		default:
			printf("UNKNOWN(%u)", mapping[iter_a].proto_type);
			break;
		}
		if (iter_a + 1 < count)
			printf(" ");
	}
	printf("\n");
}

/**
 * Output the NetLabel domain mappings in human readable format
 * @param mapping the domain mappings
 * @param count the number of domain mappings
 *
 * Helper function to be called by map_list().
 *
 */
static void map_list_print_pretty(struct nlbl_dommap *mapping, size_t count)
{
	uint32_t iter_a;
	struct nlbl_dommap_addr *iter_b;

	printf("Configured NetLabel domain mappings (%zu)\n", count);
	for (iter_a = 0; iter_a < count; iter_a++) {
		/* domain string */
		printf(" domain: ");
		if (mapping[iter_a].domain != NULL)
			printf("\"%s\"", mapping[iter_a].domain);
		else
			printf("DEFAULT");
		/* family */
		if (mapping[iter_a].family == AF_INET)
			printf(" (IPv4)\n");
		else if (mapping[iter_a].family == AF_INET6)
			printf(" (IPv6)\n");
		else if (mapping[iter_a].family == AF_UNSPEC)
			printf(" (IPv4/IPv6)\n");
		/* protocol */
		switch (mapping[iter_a].proto_type) {
		case NETLBL_NLTYPE_UNLABELED:
			printf("   protocol: UNLABELED\n");
			break;
		case NETLBL_NLTYPE_CIPSOV4:
			printf("   protocol: CIPSO, DOI = %u\n",
			       mapping[iter_a].proto.cip_doi);
			break;
		case NETLBL_NLTYPE_CALIPSO:
			printf("   protocol: CALIPSO, DOI = %u\n",
			       mapping[iter_a].proto.clp_doi);
			break;
		case NETLBL_NLTYPE_ADDRSELECT:
			iter_b = mapping[iter_a].proto.addrsel;
			while (iter_b) {
				printf("   address: ");
				nlctl_addr_print(&iter_b->addr);
				printf("\n"
				       "    protocol: ");
				switch (iter_b->proto_type) {
				case NETLBL_NLTYPE_UNLABELED:
					printf("UNLABELED\n");
					break;
				case NETLBL_NLTYPE_CIPSOV4:
					printf("CIPSO, DOI = %u\n",
					       iter_b->proto.cip_doi);
					break;
				case NETLBL_NLTYPE_CALIPSO:
					printf("CALIPSO, DOI = %u\n",
					       iter_b->proto.clp_doi);
					break;
				default:
					printf("UNKNOWN(%u)\n",
					       iter_b->proto_type);
					break;
				}
				iter_b = iter_b->next;
			}
			break;
		default:
			printf("UNKNOWN(%u)\n", mapping[iter_a].proto_type);
			break;
		}
	}
}

/**
 * List the NetLabel domains mappings
 * @param argc the number of arguments
 * @param argv the argument list
 *
 * List the configured NetLabel domain mappings.  Returns zero on success,
 * negative values on failure.
 *
 */
static int map_list(int argc, char *argv[])
{
	int rc;
	struct nlbl_dommap *mapping, *mapping_new;
	size_t count, def_count;
	uint32_t iter;
	uint16_t *family, families[] = {AF_INET, AF_INET6, AF_UNSPEC /* terminator */};

	/* get the list of mappings */
	rc = nlbl_mgmt_listall(NULL, &mapping);
	if (rc < 0)
		return rc;
	count = rc;

	/* get the default mapping */
	mapping_new = realloc(mapping, sizeof(*mapping) * (count + 2));
	if (mapping_new == NULL)
		goto list_return;
	mapping = mapping_new;
	memset(&mapping[count], 0, sizeof(*mapping) * 2);

	for (family = families, def_count = 0; *family != AF_UNSPEC; family++) {
		rc = nlbl_mgmt_listdef(NULL, *family, &mapping[count + def_count]);
		if (rc < 0 && rc != -ENOENT)
			goto list_return;
		else if (rc == 0)
			def_count += 1;
		else
			rc = 0;
	}

	/* If both defaults are unlabeled then combine them into a single entry */
	if (def_count == 2 && mapping[count].proto_type == NETLBL_NLTYPE_UNLABELED &&
	    mapping[count + 1].proto_type == NETLBL_NLTYPE_UNLABELED) {
		mapping[count].family = AF_UNSPEC;
		def_count--;
	}
	count += def_count;

	/* display the results */
	if (opt_pretty != 0)
		map_list_print_pretty(mapping, count);
	else
		map_list_print(mapping, count);

list_return:
	if (mapping != NULL) {
		for (iter = 0; iter < count; iter++)
			if (mapping[iter].domain != NULL)
				free(mapping[iter].domain);
		free(mapping);
	}
	return rc;
}

/**
 * Entry point for the NetLabel mapping functions
 * @param argc the number of arguments
 * @param argv the argument list
 *
 * Parses the argument list and performs the requested operation.  Returns zero
 * on success, negative values on failure.
 *
 */
int map_main(int argc, char *argv[])
{
	int rc;

	/* sanity checks */
	if (argc <= 0 || argv == NULL || argv[0] == NULL)
		return -EINVAL;

	/* handle the request */
	if (strcmp(argv[0], "add") == 0) {
		/* add a domain mapping */
		rc = map_add(argc - 1, argv + 1);
	} else if (strcmp(argv[0], "del") == 0) {
		/* delete a domain mapping */
		rc = map_del(argc - 1, argv + 1);
	} else if (strcmp(argv[0], "list") == 0) {
		/* list the domain mappings */
		rc = map_list(argc - 1, argv + 1);
	} else {
		/* unknown request */
		rc = -EINVAL;
	}

	return rc;
}