/*

 *   This library is free software; you can redistribute it and/or

 *   modify it under the terms of the GNU Lesser General Public

 *   License as published by the Free Software Foundation; either

 *   version 2.1 of the License, or (at your option) any later version.

 *

 *   This library is distributed in the hope that it will be useful,

 *   but WITHOUT ANY WARRANTY; without even the implied warranty of

 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

 *   Lesser General Public License for more details.

 *

 *   You should have received a copy of the GNU Lesser General Public

 *   License along with this library; if not, write to the Free Software

 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA

 */

/**

 * $Id: 7778cc7ff60b50a31fa735f3a0042e6d2414cf36 $

 *

 * @file protocols/arp/base.c

 * @brief Functions to send/receive ARP packets.

 *

 * @copyright 2020 Network RADIUS SAS <legal@networkradius.com?

 */

RCSID("$Id: 7778cc7ff60b50a31fa735f3a0042e6d2414cf36 $")

#include <freeradius-devel/util/net.h>

#include <freeradius-devel/util/struct.h>

#include <freeradius-devel/util/syserror.h>

#include <freeradius-devel/io/test_point.h>

#include "attrs.h"

#ifdef HAVE_LINUX_IF_PACKET_H

#  include <linux/if_packet.h>

#  include <linux/if_ether.h>

#endif

#include <net/if_arp.h>

#ifdef __FreeBSD__

#include <net/ethernet.h>

#include <net/if_dl.h>

#include <netlink/netlink.h>

#include <netlink/netlink_route.h>

#include <netlink/netlink_snl.h>

#include <netlink/netlink_snl_route.h>

#include <sys/param.h>

#include <sys/linker.h>

#include <sys/module.h>

#endif

static uint32_t instance_count = 0;

fr_dict_t const *dict_arp;

extern fr_dict_autoload_t libfreeradius_arp_dict[];

fr_dict_autoload_t libfreeradius_arp_dict[] = {

  { .out = &dict_arp, .proto = "arp" },

  DICT_AUTOLOAD_TERMINATOR

};

fr_dict_attr_t const *attr_arp_packet;

extern fr_dict_attr_autoload_t libfreeradius_arp_dict_attr[];

fr_dict_attr_autoload_t libfreeradius_arp_dict_attr[] = {

  { .out = &attr_arp_packet, .name = "arp", .type = FR_TYPE_STRUCT, .dict = &dict_arp },

  DICT_AUTOLOAD_TERMINATOR

};

/*

 *  grep VALUE share/dictionary/arp/dictionary.rfc826  | grep Op | awk '{print "[" $4 "] = \"" $3 "\","}'

 */

char const *fr_arp_packet_codes[FR_ARP_CODE_MAX] = {

  [1] = "Request",

  [2] = "Reply",

  [3] = "Reverse-Request",

  [4] = "Reverse-Reply",

#if 0

  [5] = "DRARP-Request",

  [6] = "DRARP-Reply",

  [7] = "DRARP-Error",

  [8] = "InARP-Request",

  [9] = "InARP-Reply",

  [10] = "ARP-NAK",

  [11] = "MARS-Request",

  [12] = "MARS-Multi",

  [13] = "MARS-MServ",

  [14] = "MARS-Join",

  [15] = "MARS-Leave",

  [16] = "MARS-NAK",

  [17] = "MARS-Unserv",

  [18] = "MARS-SJoin",

  [19] = "MARS-SLeave",

  [20] = "MARS-Grouplist-Request",

  [21] = "MARS-Grouplist-Reply",

  [22] = "MARS-Redirect-MAP",

  [23] = "MAPOS-UNARP",

  [24] = "OP_EXP1",

  [25] = "OP_EXP2",

#endif

};

static uint8_t const zeros[6] = { 0 };

#ifdef SIOCSARP

/** Forcibly add an ARP entry so we can send unicast packets to hosts that don't have IP addresses yet

 *

 * @param[in] fd  to add arp entry on.

 * @param[in] interface to add arp entry on.

 * @param[in] ipaddr  to insert into ARP table.

 * @param[in] macaddr to insert into ARP table.

 * @return

 *  - 0 on success.

 *  - -1 on failure.

 */

int fr_arp_entry_add(int fd, char const *interface, uint8_t ipaddr[static 4], uint8_t macaddr[static 6])

{

  struct sockaddr_in *sin;

  struct arpreq req;

  if (!interface) {

    fr_strerror_const("No interface specified.  Cannot update ARP table");

    return -1;

  }

  memset(&req, 0, sizeof(req));

  sin = (struct sockaddr_in *) &req.arp_pa;

  sin->sin_family = AF_INET;

  memcpy(&sin->sin_addr.s_addr, ipaddr, 4);

  strlcpy(req.arp_dev, interface, sizeof(req.arp_dev));

  memcpy(&req.arp_ha.sa_data, macaddr, 6);

  req.arp_flags = ATF_COM;

  if (ioctl(fd, SIOCSARP, &req) < 0) {

    fr_strerror_printf("Failed to add entry in ARP cache: %s (%d)", fr_syserror(errno), errno);

    return -1;

  }

  return 0;

}

#else

int fr_arp_entry_add(UNUSED int fd, UNUSED char const *interface,

         UNUSED uint8_t ipaddr[static 4], UNUSED uint8_t macaddr[static 6])

{

  fr_strerror_const("Adding ARP entry is unsupported on this system");

  return -1;

}

#endif

#ifdef __FreeBSD__

/** Use FreeBSD netlink API to add ARP entries

 */

int fr_bsd_arp_entry_add(uint32_t ifindex, uint8_t ipaddr[static 4], uint8_t macaddr[static 6])

{

  struct sockaddr_in  sin;

  struct sockaddr_dl  sdl;

  struct snl_state  state;

  struct snl_writer nw;

  struct nlmsghdr   *msghdr;

  struct ndmsg    *msg;

  struct snl_errmsg_data  errmsg = {};

  if (ifindex == 0) {

    fr_strerror_const("Missing interface index");

    return -1;

  }

  sin.sin_family = AF_INET;

  memcpy(&sin.sin_addr.s_addr, ipaddr, 4);

  sdl = (struct sockaddr_dl){

    .sdl_len = sizeof(sdl),

    .sdl_family = AF_LINK,

    .sdl_alen = ETHER_ADDR_LEN

  };

  memcpy(LLADDR(&sdl), macaddr, ETHER_ADDR_LEN);

  if (!snl_init(&state, NETLINK_ROUTE)) {

    if (modfind("netlink") == -1 && errno == ENOENT) {

      if (kldload("netlink") == -1) {

        fr_strerror_const("netlink is not loaded and load attempt failed");

        return -1;

      }

    } else {

    open_error:

      fr_strerror_const("Unable to open netlink socket");

      return -1;

    }

    if (!snl_init(&state, NETLINK_ROUTE)) goto open_error;

  }

  snl_init_writer(&state, &nw);

  msghdr = snl_create_msg_request(&nw, RTM_NEWNEIGH);

  msghdr->nlmsg_flags |= NLM_F_CREATE | NLM_F_REPLACE;

  msg = snl_reserve_msg_object(&nw, struct ndmsg);

  if (!msg) {

    fr_strerror_const("Failed reserving message");

  error:

    snl_free(&state);

    return -1;

  }

  msg->ndm_family = AF_INET;

  msg->ndm_ifindex = ifindex;

  msg->ndm_state = NUD_PERMANENT;

  msg->ndm_flags = NTF_STICKY;

  snl_add_msg_attr_ip(&nw, NDA_DST, (struct sockaddr *)&sin);

  snl_add_msg_attr(&nw, NDA_LLADDR, sdl.sdl_alen, LLADDR(&sdl));

  if (!(msghdr = snl_finalize_msg(&nw)) || !snl_send_message(&state, msghdr)) {

    fr_strerror_const("Failed sending netlink message.");

    goto error;

  }

  snl_read_reply_code(&state, msghdr->nlmsg_seq, &errmsg);

  if (errmsg.error != 0) {

    fr_strerror_printf("Failed adding ARP table entry: %s (%s)", strerror(errmsg.error), errmsg.error_str);

    goto error;

  }

  snl_free(&state);

  return 0;

}

#endif

/** Encode VPS into a raw ARP packet.

 *

 */

ssize_t fr_arp_encode(fr_dbuff_t *dbuff, uint8_t const *original, fr_pair_list_t *vps)

{

  ssize_t     slen;

  fr_pair_t   *vp;

  fr_arp_packet_t   *arp;

  fr_dcursor_t    cursor;

  fr_da_stack_t   da_stack;

  fr_dbuff_t    work_dbuff = FR_DBUFF(dbuff);

  if (fr_pair_list_empty(vps)) {

    fr_strerror_const("Cannot encode empty packet");

    return -1;

  }

  /*

   *  Get a cursor over the ARP attributes.

   */

  vp = fr_pair_dcursor_by_ancestor_init(&cursor, vps, attr_arp_packet);

  /*

   *  For simplicity, we allow the caller to omit things

   *  that they don't care about.

   */

  if (!vp) {

    fr_strerror_const("No ARP attributes in the attribute list");

    return -1;

  }

  fr_proto_da_stack_build(&da_stack, attr_arp_packet);

  FR_PROTO_STACK_PRINT(&da_stack, 0);

  /*

   *  Call the struct encoder to do the actual work.

   */

  slen = fr_struct_to_network(&work_dbuff, &da_stack, 0, &cursor, NULL, NULL, NULL);

  if (slen <= 0) return slen;

  if (slen != FR_ARP_PACKET_SIZE) return slen;

  /*

   *  Hard-code fields which can be omitted.

   */

  arp = (fr_arp_packet_t *)fr_dbuff_start(&work_dbuff);

  if ((arp->htype[0] == 0) && (arp->htype[1] == 0)) arp->htype[1] = FR_HARDWARE_FORMAT_VALUE_ETHERNET;

  if ((arp->ptype[0] == 0) && (arp->ptype[1] == 0)) arp->ptype[0] = (FR_PROTOCOL_FORMAT_VALUE_IPV4 >> 8); /* 0x0800 */

  if (arp->hlen == 0) arp->hlen = 6;

  if (arp->plen == 0) arp->plen = 4;

  /*

   *  The reply generally swaps Sender / Target addresses,

   *  BUT fills out the Sender-Hardware-Address with the

   *  queried MAC address.  Ensure that the admin doesn't

   *  have to fill out all of the fields.

   */

  if (original) {

    fr_arp_packet_t const *our_original = (fr_arp_packet_t const *) original;

#define COPY(_a, _b) do { \

  if (memcmp(arp->_a, zeros, sizeof(arp->_a)) == 0) { \

    memcpy(arp->_a, our_original->_b, sizeof(arp->_a)); \

  } \

  } while (0)

    COPY(spa, tpa);   /* answer is about the asked-for target */

    COPY(tha, sha);   /* answer is sent to the requestor hardware address */

    COPY(tpa, spa);   /* answer is sent to the requestor protocol address */

  }

  return fr_dbuff_set(dbuff, &work_dbuff);

}

/** Decode a raw ARP packet into VPs

 *

 */

ssize_t fr_arp_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t const *packet, size_t packet_len)

{

  fr_arp_packet_t const *arp;

  if (packet_len < FR_ARP_PACKET_SIZE) {

    fr_strerror_printf("Packet is too small (%d) to be ARP", (int) packet_len);

    return -1;

  }

  /*

   *  Check that the fields have the desired values.

   */

  arp = (fr_arp_packet_t const *) packet;

  if ((arp->htype[0] != 0) || (arp->htype[1] != 1)) {

    fr_strerror_const("Hardware-Format != Ethernet");

    return -1;

  }

  if ((arp->ptype[0] != 8) || (arp->ptype[1] != 0)) {

    fr_strerror_const("Protocol-Format != IPv4");

    return -1;

  }

  if (arp->hlen != 6) {

    fr_strerror_const("Hardware-Length != 6");

    return -1;

  }

  if (arp->plen != 4) {

    fr_strerror_const("Protocol-Length != 4");

    return -1;

  }

  /*

   *  If the packet is too long, we discard any extra data.

   */

  return fr_struct_from_network(ctx, out, attr_arp_packet, packet, FR_ARP_PACKET_SIZE,

              NULL, NULL, NULL);

}

int fr_arp_global_init(void)

{

  if (instance_count > 0) {

    instance_count++;

    return 0;

  }

  instance_count++;

  if (fr_dict_autoload(libfreeradius_arp_dict) < 0) {

  fail:

    instance_count--;

    return -1;

  }

  if (fr_dict_attr_autoload(libfreeradius_arp_dict_attr) < 0) {

    fr_dict_autofree(libfreeradius_arp_dict);

    goto fail;

  }

  return 0;

}

void fr_arp_global_free(void)

{

  fr_assert(instance_count > 0);

  if (--instance_count > 0) return;

  fr_dict_autofree(libfreeradius_arp_dict);

}

extern fr_dict_protocol_t libfreeradius_arp_dict_protocol;

fr_dict_protocol_t libfreeradius_arp_dict_protocol = {

  .name = "arp",

  .default_type_size = 4,

  .default_type_length = 0,

  .init = fr_arp_global_init,

  .free = fr_arp_global_free,

};

typedef struct {

  bool    tmp;

} fr_arp_ctx_t;

static int encode_test_ctx(void **out, TALLOC_CTX *ctx, UNUSED fr_dict_t const *dict,

         UNUSED fr_dict_attr_t const *root_da)

{

  fr_arp_ctx_t *test_ctx;

  fr_assert(instance_count > 0);

  test_ctx = talloc_zero(ctx, fr_arp_ctx_t);

  if (!test_ctx) return -1;

  *out = test_ctx;

  return 0;

}

/*

 *  Test points for protocol encode / decode

 *

 *  Because ARP has no TLVs, we don't have test points for pair

 *  encode / decode.

 */

static ssize_t fr_arp_encode_proto(UNUSED TALLOC_CTX *ctx, fr_pair_list_t *vps, uint8_t *data, size_t data_len, UNUSED void *proto_ctx)

{

  return fr_arp_encode(&FR_DBUFF_TMP(data, data_len), NULL, vps);

}

extern fr_test_point_proto_encode_t arp_tp_encode_proto;

fr_test_point_proto_encode_t arp_tp_encode_proto = {

  .test_ctx = encode_test_ctx,

  .func   = fr_arp_encode_proto

};

static ssize_t fr_arp_decode_proto(TALLOC_CTX *ctx, fr_pair_list_t *out,

           uint8_t const *data, size_t data_len, UNUSED void *proto_ctx)

{

  return fr_arp_decode(ctx, out, data, data_len);

}

extern fr_test_point_proto_decode_t arp_tp_decode_proto;

fr_test_point_proto_decode_t arp_tp_decode_proto = {

  .test_ctx = encode_test_ctx,

  .func   = fr_arp_decode_proto

};