/*

 * Copyright (C) 2005-2009 Martin Willi

 * Copyright (C) 2005 Jan Hutter

 *

 * Copyright (C) secunet Security Networks AG

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by the

 * Free Software Foundation; either version 2 of the License, or (at your

 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.

 *

 * This program is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY

 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * for more details.

 */

#include <stdlib.h>

#include <string.h>

#include "parser.h"

#include <library.h>

#include <daemon.h>

#include <collections/linked_list.h>

#include <encoding/payloads/encodings.h>

#include <encoding/payloads/payload.h>

#include <encoding/payloads/sa_payload.h>

#include <encoding/payloads/proposal_substructure.h>

#include <encoding/payloads/transform_substructure.h>

#include <encoding/payloads/transform_attribute.h>

#include <encoding/payloads/ke_payload.h>

#include <encoding/payloads/nonce_payload.h>

#include <encoding/payloads/id_payload.h>

#include <encoding/payloads/notify_payload.h>

#include <encoding/payloads/encrypted_payload.h>

#include <encoding/payloads/auth_payload.h>

#include <encoding/payloads/cert_payload.h>

#include <encoding/payloads/certreq_payload.h>

#include <encoding/payloads/ts_payload.h>

#include <encoding/payloads/delete_payload.h>

#include <encoding/payloads/vendor_id_payload.h>

#include <encoding/payloads/cp_payload.h>

#include <encoding/payloads/configuration_attribute.h>

#include <encoding/payloads/eap_payload.h>

#include <encoding/payloads/unknown_payload.h>

typedef struct private_parser_t private_parser_t;

/**

 * Private data stored in a context.

 *

 * Contains pointers and counters to store current state.

 */

struct private_parser_t {

  /**

   * Public members, see parser_t.

   */

  parser_t public;

  /**

   * major IKE version

   */

  uint8_t major_version;

  /**

   * Current bit for reading in input data.

   */

  uint8_t bit_pos;

  /**

   * Current byte for reading in input data.

   */

  uint8_t *byte_pos;

  /**

   * Input data to parse.

   */

  uint8_t *input;

  /**

   * Roof of input, used for length-checking.

   */

  uint8_t *input_roof;

  /**

   * Set of encoding rules for this parsing session.

   */

  encoding_rule_t *rules;

};

/**

 * Log invalid length error

 */

static bool short_input(private_parser_t *this, int number)

{

  DBG1(DBG_ENC, "  not enough input to parse rule %d %N",

     number, encoding_type_names, this->rules[number].type);

  return FALSE;

}

/**

 * Log unaligned rules

 */

static bool bad_bitpos(private_parser_t *this, int number)

{

  DBG1(DBG_ENC, "  found rule %d %N on bitpos %d",

     number, encoding_type_names, this->rules[number].type, this->bit_pos);

  return FALSE;

}

/**

 * Parse a 4-Bit unsigned integer from the current parsing position.

 */

static bool parse_uint4(private_parser_t *this, int rule_number,

            uint8_t *output_pos)

{

  if (this->byte_pos + sizeof(uint8_t) > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  switch (this->bit_pos)

  {

    case 0:

      if (output_pos)

      {

        *output_pos = *(this->byte_pos) >> 4;

      }

      this->bit_pos = 4;

      break;

    case 4:

      if (output_pos)

      {

        *output_pos = *(this->byte_pos) & 0x0F;

      }

      this->bit_pos = 0;

      this->byte_pos++;

      break;

    default:

      return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    DBG3(DBG_ENC, "   => %hhu", *output_pos);

  }

  return TRUE;

}

/**

 * Parse a 8-Bit unsigned integer from the current parsing position.

 */

static bool parse_uint8(private_parser_t *this, int rule_number,

            uint8_t *output_pos)

{

  if (this->byte_pos + sizeof(uint8_t) > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos)

  {

    return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    *output_pos = *(this->byte_pos);

    DBG3(DBG_ENC, "   => %hhu", *output_pos);

  }

  this->byte_pos++;

  return TRUE;

}

/**

 * Parse a 15-Bit unsigned integer from the current parsing position.

 */

static bool parse_uint15(private_parser_t *this, int rule_number,

             uint16_t *output_pos)

{

  if (this->byte_pos + sizeof(uint16_t) > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos != 1)

  {

    return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    memcpy(output_pos, this->byte_pos, sizeof(uint16_t));

    *output_pos = ntohs(*output_pos) & ~0x8000;

    DBG3(DBG_ENC, "   => %hu", *output_pos);

  }

  this->byte_pos += sizeof(uint16_t);

  this->bit_pos = 0;

  return TRUE;

}

/**

 * Parse a 16-Bit unsigned integer from the current parsing position.

 */

static bool parse_uint16(private_parser_t *this, int rule_number,

             uint16_t *output_pos)

{

  if (this->byte_pos + sizeof(uint16_t) > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos)

  {

    return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    memcpy(output_pos, this->byte_pos, sizeof(uint16_t));

    *output_pos = ntohs(*output_pos);

    DBG3(DBG_ENC, "   => %hu", *output_pos);

  }

  this->byte_pos += sizeof(uint16_t);

  return TRUE;

}

/**

 * Parse a 32-Bit unsigned integer from the current parsing position.

 */

static bool parse_uint32(private_parser_t *this, int rule_number,

             uint32_t *output_pos)

{

  if (this->byte_pos + sizeof(uint32_t) > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos)

  {

    return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    memcpy(output_pos, this->byte_pos, sizeof(uint32_t));

    *output_pos = ntohl(*output_pos);

    DBG3(DBG_ENC, "   => %u", *output_pos);

  }

  this->byte_pos += sizeof(uint32_t);

  return TRUE;

}

/**

 * Parse a given amount of bytes and writes them to a specific location

 */

static bool parse_bytes(private_parser_t *this, int rule_number,

            uint8_t *output_pos, int bytes)

{

  if (this->byte_pos + bytes > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos)

  {

    return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    memcpy(output_pos, this->byte_pos, bytes);

    DBG3(DBG_ENC, "   %b", output_pos, bytes);

  }

  this->byte_pos += bytes;

  return TRUE;

}

/**

 * Parse a single Bit from the current parsing position

 */

static bool parse_bit(private_parser_t *this, int rule_number,

            bool *output_pos)

{

  if (this->byte_pos + sizeof(uint8_t) > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (output_pos)

  {

    uint8_t mask;

    mask = 0x01 << (7 - this->bit_pos);

    *output_pos = *this->byte_pos & mask;

    if (*output_pos)

    { /* set to a "clean", comparable true */

      *output_pos = TRUE;

    }

    DBG3(DBG_ENC, "   => %d", *output_pos);

  }

  this->bit_pos = (this->bit_pos + 1) % 8;

  if (this->bit_pos == 0)

  {

    this->byte_pos++;

  }

  return TRUE;

}

/**

 * Parse substructures in a list.

 */

static bool parse_list(private_parser_t *this, int rule_number,

      linked_list_t **output_pos, payload_type_t payload_type, int length)

{

  linked_list_t *list = *output_pos;

  if (length < 0)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos)

  {

    return bad_bitpos(this, rule_number);

  }

  while (length > 0)

  {

    uint8_t *pos_before = this->byte_pos;

    payload_t *payload;

    DBG2(DBG_ENC, "  %d bytes left, parsing recursively %N",

       length, payload_type_names, payload_type);

    if (this->public.parse_payload(&this->public, payload_type,

                     &payload) != SUCCESS)

    {

      DBG1(DBG_ENC, "  parsing of a %N substructure failed",

         payload_type_names, payload_type);

      return FALSE;

    }

    list->insert_last(list, payload);

    length -= this->byte_pos - pos_before;

  }

  if (length != 0)

  { /* must yield exactly to zero */

    DBG1(DBG_ENC, "  length of %N substructure list invalid",

       payload_type_names, payload_type);

    return FALSE;

  }

  *output_pos = list;

  return TRUE;

}

/**

 * Parse data from current parsing position in a chunk.

 */

static bool parse_chunk(private_parser_t *this, int rule_number,

            chunk_t *output_pos, int length)

{

  if (this->byte_pos + length > this->input_roof)

  {

    return short_input(this, rule_number);

  }

  if (this->bit_pos)

  {

    return bad_bitpos(this, rule_number);

  }

  if (output_pos)

  {

    *output_pos = chunk_alloc(length);

    memcpy(output_pos->ptr, this->byte_pos, length);

    DBG3(DBG_ENC, "   %b", output_pos->ptr, length);

  }

  this->byte_pos += length;

  return TRUE;

}

METHOD(parser_t, parse_payload, status_t,

  private_parser_t *this, payload_type_t payload_type, payload_t **payload)

{

  payload_t *pld;

  void *output;

  int payload_length = 0, spi_size = 0, attribute_length = 0, header_length;

  bool attribute_format = FALSE;

  int rule_number, rule_count;

  encoding_rule_t *rule;

  /* create instance of the payload to parse */

  if (payload_is_known(payload_type, this->major_version))

  {

    pld = payload_create(payload_type);

  }

  else

  {

    pld = (payload_t*)unknown_payload_create(payload_type);

  }

  DBG2(DBG_ENC, "parsing %N payload, %d bytes left",

     payload_type_names, payload_type, this->input_roof - this->byte_pos);

  DBG3(DBG_ENC, "parsing payload from %b",

     this->byte_pos, (u_int)(this->input_roof - this->byte_pos));

  /* base pointer for output, avoids casting in every rule */

  output = pld;

  /* parse the payload with its own rules */

  rule_count = pld->get_encoding_rules(pld, &this->rules);

  for (rule_number = 0; rule_number < rule_count; rule_number++)

  {

    /* update header length for each rule, as it is dynamic (SPIs) */

    header_length = pld->get_header_length(pld);

    rule = &(this->rules[rule_number]);

    if (rule->type < PAYLOAD_LIST)

    {

      DBG2(DBG_ENC, "  parsing rule %d %N",

         rule_number, encoding_type_names, rule->type);

    }

    else

    {

      DBG2(DBG_ENC, "  parsing rule %d LIST of %N",

         rule_number, payload_type_names, rule->type - PAYLOAD_LIST);

    }

    switch ((int)rule->type)

    {

      case U_INT_4:

      {

        if (!parse_uint4(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case U_INT_8:

      case RESERVED_BYTE:

      {

        if (!parse_uint8(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case U_INT_16:

      {

        if (!parse_uint16(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case U_INT_32:

      case HEADER_LENGTH:

      {

        if (!parse_uint32(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case IKE_SPI:

      {

        if (!parse_bytes(this, rule_number, output + rule->offset, 8))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case RESERVED_BIT:

      case FLAG:

      {

        if (!parse_bit(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case PAYLOAD_LENGTH:

      {

        if (!parse_uint16(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        /* parsed u_int16 should be aligned */

        payload_length = *(uint16_t*)(output + rule->offset);

        /* all payloads must have at least 4 bytes header */

        if (payload_length < 4)

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case SPI_SIZE:

      {

        if (!parse_uint8(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        spi_size = *(uint8_t*)(output + rule->offset);

        break;

      }

      case SPI:

      {

        if (!parse_chunk(this, rule_number, output + rule->offset,

                 spi_size))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case PAYLOAD_LIST + PLV2_PROPOSAL_SUBSTRUCTURE:

      case PAYLOAD_LIST + PLV1_PROPOSAL_SUBSTRUCTURE:

      case PAYLOAD_LIST + PLV2_TRANSFORM_SUBSTRUCTURE:

      case PAYLOAD_LIST + PLV1_TRANSFORM_SUBSTRUCTURE:

      case PAYLOAD_LIST + PLV2_TRANSFORM_ATTRIBUTE:

      case PAYLOAD_LIST + PLV1_TRANSFORM_ATTRIBUTE:

      case PAYLOAD_LIST + PLV2_CONFIGURATION_ATTRIBUTE:

      case PAYLOAD_LIST + PLV1_CONFIGURATION_ATTRIBUTE:

      case PAYLOAD_LIST + PLV2_TRAFFIC_SELECTOR_SUBSTRUCTURE:

      {

        if (payload_length < header_length ||

          !parse_list(this, rule_number, output + rule->offset,

                rule->type - PAYLOAD_LIST,

                payload_length - header_length))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case CHUNK_DATA:

      {

        if (payload_length < header_length ||

          !parse_chunk(this, rule_number, output + rule->offset,

                 payload_length - header_length))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case ENCRYPTED_DATA:

      {

        if (!parse_chunk(this, rule_number, output + rule->offset,

                 this->input_roof - this->byte_pos))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case ATTRIBUTE_FORMAT:

      {

        if (!parse_bit(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        attribute_format = *(bool*)(output + rule->offset);

        break;

      }

      case ATTRIBUTE_TYPE:

      {

        if (!parse_uint15(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      case ATTRIBUTE_LENGTH:

      {

        if (!parse_uint16(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        attribute_length = *(uint16_t*)(output + rule->offset);

        break;

      }

      case ATTRIBUTE_LENGTH_OR_VALUE:

      {

        if (!parse_uint16(this, rule_number, output + rule->offset))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        attribute_length = *(uint16_t*)(output + rule->offset);

        break;

      }

      case ATTRIBUTE_VALUE:

      {

        if (attribute_format == FALSE &&

          !parse_chunk(this, rule_number, output + rule->offset,

                 attribute_length))

        {

          pld->destroy(pld);

          return PARSE_ERROR;

        }

        break;

      }

      default:

      {

        DBG1(DBG_ENC, "  no rule to parse rule %d %N",

           rule_number, encoding_type_names, rule->type);

        pld->destroy(pld);

        return PARSE_ERROR;

      }

    }

    /* process next rule */

    rule++;

  }

  *payload = pld;

  DBG2(DBG_ENC, "parsing %N payload finished",

     payload_type_names, payload_type);

  return SUCCESS;

}

METHOD(parser_t, get_remaining_byte_count, int,

  private_parser_t *this)

{

  return this->input_roof - this->byte_pos;

}

METHOD(parser_t, reset_context, void,

  private_parser_t *this)

{

  this->byte_pos = this->input;

  this->bit_pos = 0;

}

METHOD(parser_t, set_major_version, void,

  private_parser_t *this, uint8_t major_version)

{

  this->major_version = major_version;

}

METHOD(parser_t, destroy, void,

  private_parser_t *this)

{

  free(this);

}

/*

 * Described in header.

 */

parser_t *parser_create(chunk_t data)

{

  private_parser_t *this;

  INIT(this,

    .public = {

      .parse_payload = _parse_payload,

      .reset_context = _reset_context,

      .set_major_version = _set_major_version,

      .get_remaining_byte_count = _get_remaining_byte_count,

      .destroy = _destroy,

    },

    .input = data.ptr,

    .byte_pos = data.ptr,

    .input_roof = data.ptr + data.len,

  );

  return &this->public;

}