/*

 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.

 *

 * SPDX-License-Identifier: curl

 */

/// @file

/// @brief Implementation of MockServerBase — shared trampolines, shared

///        select() helper, DriveScenario multi-handle RAII, and the scheme

///        classifier that produces the right subclass for a Scenario.

#include "proto_fuzzer/mock_server_base.h"

#include <curl/multi.h>

#include <sys/select.h>

#include "proto_fuzzer/curl_raii.h"

#include "proto_fuzzer/mock_server.h"

#include "proto_fuzzer/multi_socket_driver.h"

namespace proto_fuzzer {

namespace {

constexpr long kSelectTimeoutUs = 1000;  // 1 ms; explicit timing cases only.

}  // namespace

/// @brief C trampoline for CURLOPT_OPENSOCKETFUNCTION. Declared at namespace

///        scope so it can be a friend of MockServerBase.

/// @param clientp Pointer to the MockServerBase instance.

/// @param purpose The socket role curl is asking the mock to provide.

/// @param address Curl's mutable description of the intended destination.

/// @return The client-side socket fd as a curl_socket_t.

curl_socket_t MockServerBaseOpenSocketTrampoline(void* clientp, curlsocktype purpose, struct curl_sockaddr* address) {

  return static_cast<MockServerBase*>(clientp)->HandleOpenSocket(purpose, address);

}

/// Translate explicit peer transport metadata into curl's sockopt callback

/// contract. The descriptor is used only as an opaque identity; sandbox

/// policy must not decide whether an otherwise valid in-process transport can

/// run.

/// @param clientp Pointer to the MockServerBase instance.

/// @param curlfd Descriptor returned by the open-socket callback.

/// @param purpose Socket role assigned by curl.

/// @return CURL_SOCKOPT_ALREADY_CONNECTED for prepared stream peers, otherwise

///         CURL_SOCKOPT_OK.

int MockServerBaseSockOptTrampoline(void* clientp, curl_socket_t curlfd, curlsocktype purpose) {

  const auto disposition = static_cast<MockServerBase*>(clientp)->GetSocketSetupDisposition(curlfd, purpose);

  return disposition == SocketSetupDisposition::kAlreadyConnected ? CURL_SOCKOPT_ALREADY_CONNECTED : CURL_SOCKOPT_OK;

}

/// Default-construct an empty base instance with no connection.

MockServerBase::MockServerBase()

    : connection_(nullptr),

      pending_recv_buf_bytes_(0),

      pending_drain_limit_(0),

      multi_socket_driver_(nullptr),

      additional_handle_cleanup_count_(0),

      resume_response_(false) {}

/// Out-of-line destructor so MockConnection can stay forward-declared in the

/// base header (its complete type is only needed where unique_ptr is

/// instantiated for destruction).

MockServerBase::~MockServerBase() = default;

/// @return the owned MockConnection, or nullptr if one has not been opened.

MockConnection* MockServerBase::connection() { return connection_.get(); }

/// Install the common socket-callback trio. All subclasses share the same

/// trampoline; dispatch to the subclass happens through HandleOpenSocket().

void MockServerBase::Install(CURL* easy) {

  curl_easy_setopt(easy, CURLOPT_OPENSOCKETFUNCTION, &MockServerBaseOpenSocketTrampoline);

  curl_easy_setopt(easy, CURLOPT_OPENSOCKETDATA, this);

  curl_easy_setopt(easy, CURLOPT_SOCKOPTFUNCTION, &MockServerBaseSockOptTrampoline);

  curl_easy_setopt(easy, CURLOPT_SOCKOPTDATA, this);

}

SocketSetupDisposition MockServerBase::GetSocketSetupDisposition(curl_socket_t /*curlfd*/, curlsocktype purpose) const {

  // curl itself accepted CURLSOCKTYPE_ACCEPT descriptors, so they must follow

  // its normal post-accept option path. Every IPCXN socket returned by the

  // ordinary stream mocks is one end of an already-connected socketpair.

  return purpose == CURLSOCKTYPE_ACCEPT ? SocketSetupDisposition::kNeedsSetup

                                        : SocketSetupDisposition::kAlreadyConnected;

}

/// Ordinary event-driven mocks need no upload-callback hook; their RunLoop

/// regains control after each perform and drains client traffic there.

void MockServerBase::ConfigureRequestData(ScenarioRequestData* /*request_data*/) {}

/// Allocate a multi, attach 'easy', delegate to the subclass RunLoop, consume

/// its completion message, and clean up. Harness setup failures return a

/// stable sentinel; fuzzer callers may ignore it while unit tests can assert

/// the protocol result without adding another callback or global.

CURLcode MockServerBase::DriveScenario(CURL* easy, const curl::fuzzer::proto::Scenario& scenario, bool use_multi_socket,

                                       bool wake_multi, bool resume_response) {

  // Cache backpressure knobs so HandleOpenSocket can apply them the moment

  // connection_ exists. Both default to 0, which matches the legacy "drain

  // greedily, kernel-default buffers" behaviour exactly.

  const auto& bp = scenario.connection().backpressure();

  pending_recv_buf_bytes_ = static_cast<int>(bp.recv_buf_bytes());

  pending_drain_limit_ = static_cast<std::size_t>(bp.drain_limit());

  additional_handle_cleanup_count_ = 0;

  resume_response_ = resume_response;

  CurlMultiPtr multi(curl_multi_init());

  if (multi == nullptr) {

    resume_response_ = false;

    return CURLE_FAILED_INIT;

  }

  CURLcode transfer_result = CURLE_FAILED_INIT;

  // Callback data must survive both remove_handle and multi_cleanup, since

  // either may emit CURL_POLL_REMOVE. Keeping it in this outer scope provides

  // that lifetime without allocating per-watch state.

  MultiSocketDriver socket_driver;

  if (use_multi_socket && socket_driver.Install(multi.get())) {

    multi_socket_driver_ = &socket_driver;

  }

  if (curl_multi_add_handle(multi.get(), easy) == CURLM_OK) {

    if (wake_multi) {

      if (multi_socket_driver_ != nullptr) {

        multi_socket_driver_->ProbeControlApis();

      } else {

        long timeout_ms = -1;

        (void)curl_multi_timeout(multi.get(), &timeout_ms);

        (void)curl_multi_wakeup(multi.get());

      }

    }

    RunLoop(multi.get(), easy, scenario);

    // Completion messages are the multi API's only durable record of the

    // transfer result. Consume them while all easy handles are still attached:

    // otherwise every scenario systematically skips curl_multi_info_read's

    // result path and removal discards the opportunity. An accepted HTTP/2

    // push can contribute one additional completion message; only the caller's

    // parent determines DriveScenario's result.

    int messages_remaining = 0;

    CURLMsg* message = nullptr;

    while ((message = curl_multi_info_read(multi.get(), &messages_remaining)) != nullptr) {

      if (message->msg == CURLMSG_DONE && message->easy_handle == easy) {

        transfer_result = message->data.result;

      }

    }

    // CURL_PUSH_OK transfers ownership of each automatically-added easy to

    // the application. Enumerate attached handles only after draining their

    // completion messages, then honor the public remove-before-cleanup

    // lifecycle. The original `easy` remains caller-owned.

    CURL** handles = curl_multi_get_handles(multi.get());

    if (handles != nullptr) {

      for (std::size_t index = 0; handles[index] != nullptr; ++index) {

        CURL* handle = handles[index];

        if (handle != easy && curl_multi_remove_handle(multi.get(), handle) == CURLM_OK) {

          curl_easy_cleanup(handle);

          ++additional_handle_cleanup_count_;

        }

      }

      curl_free(handles);

    }

    curl_multi_remove_handle(multi.get(), easy);

  }

  multi.reset();

  multi_socket_driver_ = nullptr;

  resume_response_ = false;

  return transfer_result;

}

/// Preserve a safe fallback for protocol mocks that require an outer driver

/// to make progress. The API policy currently forces HTTP, whose override can

/// preload its bounded response and call curl_easy_perform without a thread.

void MockServerBase::DriveEasyScenario(CURL* easy, const curl::fuzzer::proto::Scenario& scenario, bool /*use_events*/) {

  DriveScenario(easy, scenario);

}

ConnectOnlyRunStats MockServerBase::DriveConnectOnlyScenario(CURL* easy,

                                                             const curl::fuzzer::proto::Scenario& scenario) {

  ConnectOnlyRunStats stats;

  stats.connect_result = DriveScenario(easy, scenario);

  return stats;

}

/// Expose only the current callback state to protocol drive loops. Ownership

/// remains in DriveScenario so no subclass can accidentally shorten it.

MultiSocketDriver* MockServerBase::multi_socket_driver() { return multi_socket_driver_; }

std::size_t MockServerBase::additional_handle_cleanup_count() const { return additional_handle_cleanup_count_; }

void MockServerBase::ResumeResponseIfRequested(CURL* easy) {

  if (resume_response_) {

    (void)curl_easy_pause(easy, CURLPAUSE_CONT);

  }

}

/// Hand the cached backpressure config to the connection. Safe to call when

/// connection_ is null (no-op) or when both knobs are 0 (ApplyBackpressure

/// itself is a no-op in that case).

void MockServerBase::ApplyPendingBackpressure() {

  if (connection_) {

    connection_->ApplyBackpressure(pending_recv_buf_bytes_, pending_drain_limit_);

  }

}

/// Treat a non-default BackpressureConfig as an explicit request for the

/// slower, timed drive policy. Proto3 scalar defaults make this deterministic:

/// a present-but-empty message remains on the ordinary fast path.

/// @param scenario Scenario whose backpressure settings select the policy.

/// @return true when the scenario explicitly opted into socket backpressure.

bool MockServerBase::UsesTimedDrive(const curl::fuzzer::proto::Scenario& scenario) {

  const auto& bp = scenario.connection().backpressure();

  return bp.recv_buf_bytes() != 0 || bp.drain_limit() != 0;

}

/// Wait on curl's fdset with a short timeout. Returns select()'s result; on

/// error sets *rc to the corresponding CURLMcode.

int MockServerBase::WaitOnMultiFdset(CURLM* multi, CURLMcode* rc) {

  fd_set readfds;

  fd_set writefds;

  fd_set excfds;

  FD_ZERO(&readfds);

  FD_ZERO(&writefds);

  FD_ZERO(&excfds);

  int maxfd = -1;

  *rc = curl_multi_fdset(multi, &readfds, &writefds, &excfds, &maxfd);

  if (*rc != CURLM_OK) {

    return -1;

  }

  if (maxfd < 0) {

    return 0;

  }

  struct timeval timeout;

  timeout.tv_sec = 0;

  timeout.tv_usec = kSelectTimeoutUs;

  return ::select(maxfd + 1, &readfds, &writefds, &excfds, &timeout);

}

/// Exercise curl_multi_poll's pollset/filter traversal once without sleeping.

/// The result is deliberately ignored: this is an API/state probe, while the

/// protocol-specific perform loop remains the authority on transfer progress.

void MockServerBase::ProbeMultiPollset(CURLM* multi) {

  int numfds = 0;

  (void)curl_multi_poll(multi, nullptr, 0, 0, &numfds);

}

}  // namespace proto_fuzzer