/*
 * verify.c -- running verifiers and serving the zone to be verified.
 *
 * Copyright (c) 2012-2020, NLnet Labs. All rights reserved.
 *
 * See LICENSE for the license.
 *
 */

#include "config.h"

#include <assert.h>
#include <ctype.h>
#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifdef HAVE_SYSLOG_H
#include <syslog.h>
#endif /* HAVE_SYSLOG_H */
#include <unistd.h>
#include <fcntl.h>
#include <sys/wait.h>

#include "region-allocator.h"
#include "namedb.h"
#include "nsd.h"
#include "options.h"
#include "difffile.h"
#include "verify.h"
#include "popen3.h"

struct zone *verify_next_zone(struct nsd *nsd, struct zone *zone)
{
	int verify;
	struct radnode *node;

	if(zone != NULL) {
		node = radix_next(zone->node);
	} else {
		node = radix_first(nsd->db->zonetree);
	}

	while(node != NULL) {
		zone = (struct zone *)node->elem;
		verify = zone->opts->pattern->verify_zone;
		if(verify == VERIFY_ZONE_INHERIT) {
			verify = nsd->options->verify_zones;
		}
		if(verify && zone->is_updated && !zone->is_checked) {
			return zone;
		}
		node = radix_next(node);
	}

	return NULL;
}

static inline ssize_t fill_buffer(struct verifier_stream *stream)
{
	ssize_t cnt = 0;

	assert(stream);
	assert(stream->fd != -1);
	assert(stream->cnt <= LOGBUFSIZE);
	assert(stream->off <= stream->cnt);

	// move data to start of buffer assuming all complete lines are printed
	if (stream->off) {
		size_t len = stream->cnt - stream->off;
		memmove(stream->buf, stream->buf + stream->off, len);
		stream->off = 0;
		stream->cnt = len;
		stream->buf[stream->cnt] = '\0'; // always null-terminate
	}

	// read data if space is available
	cnt = read(stream->fd, stream->buf + stream->cnt, LOGBUFSIZE - stream->cnt);
	if (cnt > 0)
		stream->cnt += (size_t)cnt;
	assert(stream->cnt <= LOGBUFSIZE);
	assert(stream->off <= stream->cnt);
	stream->buf[stream->cnt] = '\0'; // always null-terminate

	return cnt;
}

static inline size_t print_line(struct verifier_stream *stream, int eof)
{
	char *eol = NULL;
	size_t len;
	const char *fmt;

	if (stream->cnt == 0)
		return 0;
	assert(stream->off <= stream->cnt);
	if (stream->off == stream->cnt)
		return 0;

	// try to locate natural line break
	assert(stream->buf[stream->cnt] == '\0');
	if ((eol = strchr(stream->buf + stream->off, '\n'))) {
		len = eol - (stream->buf + stream->off);
	} else {
		len = stream->cnt - stream->off;
	}

	assert(len <= (stream->cnt - stream->off));
	// wait for buffer to contain a full line except on eof
	if (len < LOGLINELEN && !eol && !eof)
		return 0;

	if (len > LOGLINELEN) {
		fmt = stream->cut ? "verifier: .. %.*s .." : "verifier: %.*s ..";
		len = LOGLINELEN; // remainder printed next iteration
		stream->cut = 1;
	} else {
		fmt = stream->cut ? "verifier: .. %.*s" : "verifier: %.*s";
		stream->cut = 0;
	}
	log_msg(stream->priority, fmt, len, stream->buf + stream->off);

	stream->off += len + (eol != NULL);
	assert(stream->off <= stream->cnt);
	return len;
}

/*
 * Log verifier output on STDOUT and STDERR. Lines longer than LOGLINELEN are
 * split over multiple lines. Line-breaks are indicated in the log with "...".
 */
static void verify_handle_stream(int fd, short event, void *arg)
{
	int eof = 0;
	ssize_t cnt;
	struct verifier *verifier;
	struct verifier_stream *stream;

	assert(event & EV_READ);
	assert(arg != NULL);

	verifier = (struct verifier *)arg;
	if (fd == verifier->output_stream.fd) {
		stream = &verifier->output_stream;
	} else {
		assert(fd == verifier->error_stream.fd);
		stream = &verifier->error_stream;
	}

	assert(stream);
	assert(stream->fd != -1);

	do {
		cnt = fill_buffer(stream);
		eof = !cnt || (cnt < 0 && errno != EAGAIN && errno != EINTR);
		while (print_line(stream, eof)) ;
	} while (cnt > 0);

	if(eof) {
		event_del(&stream->event);
		close(stream->fd);
		stream->fd = -1;
	}
}

static void kill_verifier(struct verifier *verifier)
{
	assert(verifier != NULL);
	assert(verifier->zone != NULL);

	if(kill(verifier->pid, SIGTERM) == -1) {
		log_msg(LOG_ERR, "verify: cannot kill verifier for "
		                 "zone %s (pid %d): %s",
		                 verifier->zone->opts->name,
		                 verifier->pid,
		                 strerror(errno));
	}
}

static void close_stream(struct verifier *verifier, struct verifier_stream *stream)
{
	if (stream->fd == -1)
		return;
	verify_handle_stream(stream->fd, EV_READ, verifier);
	if (stream->fd == -1)
		return;
	event_del(&stream->event);
	close(stream->fd);
	stream->fd = -1;
}

static void close_verifier(struct verifier *verifier)
{
	/* unregister events and close streams (in that order) */
	if(verifier->timeout.tv_sec > 0) {
		event_del(&verifier->timeout_event);
		verifier->timeout.tv_sec = 0;
		verifier->timeout.tv_usec = 0;
	}

	if(verifier->zone_feed.fh != NULL) {
		event_del(&verifier->zone_feed.event);
		fclose(verifier->zone_feed.fh);
		verifier->zone_feed.fh = NULL;
		region_destroy(verifier->zone_feed.region);
	}

	close_stream(verifier, &verifier->error_stream);
	close_stream(verifier, &verifier->output_stream);

	verifier->zone->is_ok = verifier->was_ok;
	verifier->pid = -1;
	verifier->zone = NULL;
}

/*
 * Feed zone to verifier over STDIN as it becomes available.
 */
static void verify_handle_feed(int fd, short event, void *arg)
{
	struct verifier *verifier;
	struct rr *rr;

	(void)fd;
	assert(event == EV_WRITE);
	assert(arg != NULL);

	verifier = (struct verifier *)arg;
	if((rr = zone_rr_iter_next(&verifier->zone_feed.rriter)) != NULL) {
		print_rr(verifier->zone_feed.fh,
		         verifier->zone_feed.rrprinter,
		         rr,
		         verifier->zone_feed.region,
		         verifier->zone_feed.buffer);
	} else {
		event_del(&verifier->zone_feed.event);
		fclose(verifier->zone_feed.fh);
		verifier->zone_feed.fh = NULL;
		region_destroy(verifier->zone_feed.region);
	}
}

/*
 * This handler will be called when a verifier-timeout alarm goes off. It just
 * kills the verifier. server_verify_zones will make sure the zone will be
 * considered bad.
 */
void verify_handle_timeout(int fd, short event, void *arg)
{
	struct verifier *verifier;

	(void)fd;
	assert(event & EV_TIMEOUT);
	assert(arg != NULL);

	verifier = (struct verifier *)arg;
	verifier->zone->is_bad = 1;

	log_msg(LOG_ERR, "verify: verifier for zone %s (pid %d) timed out",
	                 verifier->zone->opts->name, verifier->pid);

	/* kill verifier, process reaped by exit handler */
	kill_verifier(verifier);
}

void verify_handle_signal(int sig, short event, void *arg)
{
	char buf[1] = { '\0' };
	struct nsd *nsd;

	assert(sig == SIGCHLD);
	assert(event & EV_SIGNAL);
	assert(arg != NULL);

	nsd = (struct nsd *)arg;
	if(write(nsd->verifier_pipe[1], buf, sizeof(buf)) == -1) {
		log_msg(LOG_ERR, "verify_handle_signal: write failed: %s",
				strerror(errno));
	}
}

/*
 * Reap process and update status of respective zone based on the exit code
 * of a verifier. Everything from STDOUT and STDERR still available is read and
 * written to the log as it might contain valuable information.
 *
 * NOTE: A timeout might have caused the verifier to be terminated.
 */
void verify_handle_exit(int fd, short event, void *arg)
{
	int wstatus;
	pid_t pid;
	struct nsd *nsd;
	char buf[1];

	assert(event & EV_READ);
	assert(arg != NULL);

	nsd = (struct nsd *)arg;

	if(read(fd, buf, sizeof(buf)) == -1) {
		if(errno != EAGAIN && errno != EINTR && errno != EWOULDBLOCK)
			log_msg(LOG_ERR, "verify_handle_exit: read failed: %s",
				strerror(errno));
	}

	while(((pid = waitpid(-1, &wstatus, WNOHANG)) == -1 && errno == EINTR)
	    || (pid > 0))
	{
		struct verifier *verifier = NULL;

		for(size_t i = 0; !verifier && i < nsd->verifier_limit; i++) {
			if(nsd->verifiers[i].zone != NULL &&
			   nsd->verifiers[i].pid == pid)
			{
				verifier = &nsd->verifiers[i];
			}
		}

		if(verifier == NULL) {
			continue;
		}

		if(!WIFEXITED(wstatus)) {
			log_msg(LOG_ERR, "verify: verifier for zone %s "
			                 "(pid %d) exited abnormally",
			                 verifier->zone->opts->name, pid);
		} else {
			int priority = LOG_INFO;
			int status = WEXITSTATUS(wstatus);
			if(status != 0) {
				priority = LOG_ERR;
				verifier->zone->is_bad = 1;
			}
			log_msg(priority, "verify: verifier for zone %s "
			                  "(pid %d) exited with %d",
			                  verifier->zone->opts->name, pid, status);
		}

		close_verifier(verifier);
		nsd->verifier_count--;
	}

	while(nsd->mode == NSD_RUN &&
	      nsd->verifier_count < nsd->verifier_limit &&
	      nsd->next_zone_to_verify != NULL)
	{
		verify_zone(nsd, nsd->next_zone_to_verify);
		nsd->next_zone_to_verify
			= verify_next_zone(nsd, nsd->next_zone_to_verify);
	}

	if(nsd->next_zone_to_verify == NULL && nsd->verifier_count == 0) {
		event_base_loopexit(nsd->event_base, NULL);
		return;
	}
}

/*
 * A parent may be terminated (by the NSD_QUIT signal (nsdc stop command)).
 * When a reload server process is running, the parent will then send a
 * NSD_QUIT command to that server. This handler makes sure that this command
 * is not neglected and that the reload server process will exit (gracefully).
 */
void
verify_handle_command(int fd, short event, void *arg)
{
	struct nsd *nsd = (struct nsd *)arg;
	int len;
	sig_atomic_t mode;

	assert(nsd != NULL);
	assert(event & (EV_READ
#ifdef EV_CLOSED
	| EV_CLOSED
#endif
	));

	if((len = read(fd, &mode, sizeof(mode))) == -1) {
		log_msg(LOG_ERR, "verify: verify_handle_command: read: %s",
		                 strerror(errno));
		return;
	} else if(len == 0) {
		log_msg(LOG_INFO, "verify: command channel closed");
		mode = NSD_QUIT;
	} else if(mode != NSD_QUIT) {
		log_msg(LOG_ERR, "verify: bad command: %d", (int)mode);
		return;
	}

	nsd->mode = mode;

	if(nsd->verifier_count == 0) {
		event_base_loopexit(nsd->event_base, NULL);
		return; /* exit early if no verifiers are executing */
	}

	/* kill verifiers, processes reaped elsewhere */
	for(size_t i = 0; i < nsd->verifier_limit; i++) {
		if(nsd->verifiers[i].zone != NULL) {
			kill_verifier(&nsd->verifiers[i]);
		}
	}
}

/*
 * A verifier is executed for the specified zone (if a verifier is configured
 * and the zone has not been verified before). If one of the verifiers exits
 * with non-zero, the zone is marked bad and nsd drops the zone update and
 * reloads again.
 */
void verify_zone(struct nsd *nsd, struct zone *zone)
{
	struct verifier *verifier = NULL;
	int32_t timeout;
	char **command;
	FILE *fin;
	int fdin, fderr, fdout, flags;

	assert(nsd != NULL);
	assert(nsd->verifier_count < nsd->verifier_limit);
	assert(zone != NULL);

	fin = NULL;
	fdin = fdout = fderr = -1;

	/* search for available verifier slot */
	for(size_t i = 0; i < nsd->verifier_limit && !verifier; i++) {
		if(nsd->verifiers[i].zone == NULL) {
			verifier = &nsd->verifiers[i];
		}
	}

	assert(verifier != NULL);

	if(zone->opts->pattern->verifier != NULL) {
		command = zone->opts->pattern->verifier;
	} else if (nsd->options->verifier != NULL) {
		command = nsd->options->verifier;
	} else {
		log_msg(LOG_ERR, "verify: no verifier for zone %s",
		                 zone->opts->name);
		return;
	}

	if(zone->opts->pattern->verifier_timeout
		!= VERIFIER_TIMEOUT_INHERIT)
	{
		timeout = zone->opts->pattern->verifier_timeout;
	} else {
		timeout = nsd->options->verifier_timeout;
	}

	if(zone->opts->pattern->verifier_feed_zone
		!= VERIFIER_FEED_ZONE_INHERIT)
	{
		fdin = zone->opts->pattern->verifier_feed_zone ? -2 : -1;
	} else {
		fdin = nsd->options->verifier_feed_zone ? -2 : -1;
	}

	assert(timeout >= 0);

	setenv("VERIFY_ZONE", zone->opts->name, 1);
	setenv("VERIFY_ZONE_ON_STDIN", fdin == -2 ? "yes" : "no", 1);

	verifier->pid = popen3(
		command, fdin == -2 ? &fdin : NULL, &fdout, &fderr);
	if(verifier->pid == -1) {
		log_msg(LOG_ERR, "verify: could not start verifier for zone "
				 "%s: %s", zone->opts->name, strerror(errno));
		goto fail_popen3;
	}
	flags = fcntl(fderr, F_GETFL, 0);
	if (fcntl(fderr, F_SETFL, flags | O_NONBLOCK) == -1) {
		log_msg(LOG_ERR, "verify: fcntl(stderr, ..., O_NONBLOCK) for "
		                 "zone %s: %s",
		                 zone->opts->name, strerror(errno));
		goto fail_fcntl;
	}
	flags = fcntl(fdout, F_GETFL, 0);
	if(fcntl(fdout, F_SETFL, flags | O_NONBLOCK) == -1) {
		log_msg(LOG_ERR, "verify: fcntl(stdout, ..., O_NONBLOCK) for "
		                 "zone %s: %s",
		                 zone->opts->name, strerror(errno));
		goto fail_fcntl;
	}
	if (fdin >= 0) {
		if ((fin = fdopen(fdin, "w")) == NULL) {
			log_msg(LOG_ERR, "verify: fdopen(stdin, ...) for "
			                 "zone %s: %s",
		                         zone->opts->name, strerror(errno));
			goto fail_fcntl;
		}
		/* write unbuffered */
		setbuf(fin, NULL);
	}

	verifier->zone = zone;
	verifier->was_ok = zone->is_ok;

	unsetenv("VERIFY_ZONE");
	unsetenv("VERIFY_ZONE_ON_STDIN");

	verifier->error_stream.fd = fderr;
	verifier->error_stream.cnt = 0;
	verifier->error_stream.off = 0;
	verifier->error_stream.buf[0] = '\0';
	event_set(&verifier->error_stream.event,
	          verifier->error_stream.fd,
	          EV_READ|EV_PERSIST,
	          verify_handle_stream,
		  verifier);
	event_base_set(nsd->event_base, &verifier->error_stream.event);
	if(event_add(&verifier->error_stream.event, NULL) != 0) {
		log_msg(LOG_ERR, "verify: could not add error event for "
		                 "zone %s", zone->opts->name);
		goto fail_stderr;
	}

	verifier->output_stream.fd = fdout;
	verifier->output_stream.cnt = 0;
	verifier->output_stream.off = 0;
	verifier->output_stream.buf[0] = '\0';
	event_set(&verifier->output_stream.event,
	          verifier->output_stream.fd,
	          EV_READ|EV_PERSIST,
	          verify_handle_stream,
	          verifier);
	event_base_set(nsd->event_base, &verifier->output_stream.event);
	if(event_add(&verifier->output_stream.event, NULL) != 0) {
		log_msg(LOG_ERR, "verify: could not add output event for "
		                 "zone %s", zone->opts->name);
		goto fail_stdout;
	}

	if(fin != NULL) {
		verifier->zone_feed.fh = fin;

		zone_rr_iter_init(&verifier->zone_feed.rriter, zone);

		verifier->zone_feed.rrprinter
			= create_pretty_rr(nsd->server_region);
		verifier->zone_feed.region
			= region_create(xalloc, free);
		verifier->zone_feed.buffer
			= buffer_create(nsd->server_region, MAX_RDLENGTH);

		event_set(&verifier->zone_feed.event,
		          fileno(verifier->zone_feed.fh),
			  EV_WRITE|EV_PERSIST,
			  &verify_handle_feed,
			  verifier);
		event_base_set(nsd->event_base, &verifier->zone_feed.event);
		if(event_add(&verifier->zone_feed.event, NULL) != 0) {
			log_msg(LOG_ERR, "verify: could not add input event "
			                 "for zone %s", zone->opts->name);
			goto fail_stdin;
		}
	}

	if(timeout > 0) {
		verifier->timeout.tv_sec = timeout;
		verifier->timeout.tv_usec = 0;
		event_set(&verifier->timeout_event,
		          -1,
		          EV_TIMEOUT,
		          verify_handle_timeout,
		          verifier);
		event_base_set(nsd->event_base, &verifier->timeout_event);
		if(event_add(&verifier->timeout_event, &verifier->timeout) != 0) {
			log_msg(LOG_ERR, "verify: could not add timeout event "
			                 "for zone %s", zone->opts->name);
			goto fail_timeout;
		}

		log_msg(LOG_INFO, "verify: started verifier for zone %s "
		                  "(pid %d), timeout is %d seconds",
		                  zone->opts->name, verifier->pid, timeout);
	} else {
		log_msg(LOG_INFO, "verify: started verifier for zone %s "
		                  "(pid %d)", zone->opts->name, verifier->pid);
	}

	zone->is_ok = 1;
	nsd->verifier_count++;
	return;

fail_timeout:
	verifier->timeout.tv_sec = 0;
	verifier->timeout.tv_usec = 0;
	if(fin != NULL) {
		event_del(&verifier->zone_feed.event);
	}
fail_stdin:
	verifier->zone_feed.fh = NULL;
	event_del(&verifier->output_stream.event);
fail_stdout:
	verifier->output_stream.fd = -1;
	event_del(&verifier->error_stream.event);
fail_stderr:
	verifier->error_stream.fd = -1;
fail_fcntl:
	kill_verifier(verifier);
	if(fin != NULL) {
		fclose(fin);
	} else if (fdin >= 0) {
		close(fdin);
	}
	close(fdout);
	close(fderr);
fail_popen3:
	zone->is_bad = 1;
	verifier->pid = -1;
	verifier->zone = NULL;
}