/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2023 Dmitry Chagin <dchagin@FreeBSD.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/param.h>
#include <sys/capsicum.h>
#include <sys/extattr.h>
#include <sys/fcntl.h>
#include <sys/file.h>
#include <sys/namei.h>
#include <sys/proc.h>
#include <sys/syscallsubr.h>
#include <sys/vnode.h>

#include <security/mac/mac_framework.h>

#ifdef COMPAT_LINUX32
#include <machine/../linux32/linux.h>
#include <machine/../linux32/linux32_proto.h>
#else
#include <machine/../linux/linux.h>
#include <machine/../linux/linux_proto.h>
#endif

#include <compat/linux/linux_util.h>

#define	LINUX_XATTR_SIZE_MAX	65536
#define	LINUX_XATTR_LIST_MAX	65536
#define	LINUX_XATTR_NAME_MAX	255

#define	LINUX_XATTR_CREATE	0x1
#define	LINUX_XATTR_REPLACE	0x2
#define	LINUX_XATTR_FLAGS	(LINUX_XATTR_CREATE | LINUX_XATTR_REPLACE)

struct listxattr_args {
	int		fd;
	const char	*path;
	char		*list;
	l_size_t	size;
	int		follow;
};

struct setxattr_args {
	int		fd;
	const char	*path;
	const char	*name;
	void 		*value;
	l_size_t	size;
	l_int		flags;
	int		follow;
};

struct getxattr_args {
	int		fd;
	const char	*path;
	const char	*name;
	void 		*value;
	l_size_t	size;
	int		follow;
};

struct removexattr_args {
	int		fd;
	const char	*path;
	const char	*name;
	int		follow;
};

static char *extattr_namespace_names[] = EXTATTR_NAMESPACE_NAMES;


static int
error_to_xattrerror(int attrnamespace, int error)
{

	if (attrnamespace == EXTATTR_NAMESPACE_SYSTEM && error == EPERM)
		return (ENOTSUP);
	else
		return (error);
}

static int
xattr_to_extattr(const char *uattrname, int *attrnamespace, char *attrname)
{
	char uname[LINUX_XATTR_NAME_MAX + 1], *dot;
	size_t len, cplen;
	int error;

	error = copyinstr(uattrname, uname, sizeof(uname), &cplen);
	if (error != 0)
		return (error);
	if (cplen == sizeof(uname))
		return (ERANGE);
	dot = strchr(uname, '.');
	if (dot == NULL)
		return (ENOTSUP);
	*dot = '\0';
	for (*attrnamespace = EXTATTR_NAMESPACE_USER;
	    *attrnamespace < nitems(extattr_namespace_names);
	    (*attrnamespace)++) {
		if (bcmp(uname, extattr_namespace_names[*attrnamespace],
		    dot - uname + 1) == 0) {
			dot++;
			len = strlen(dot) + 1;
			bcopy(dot, attrname, len);
			return (0);
		}
	}
	return (ENOTSUP);
}

static int
listxattr(struct thread *td, struct listxattr_args *args)
{
	char attrname[LINUX_XATTR_NAME_MAX + 1];
	char *data, *prefix, *key;
	cap_rights_t rights;
	struct file *fp = NULL;
	struct uio auio;
	struct iovec aiov;
	unsigned char keylen;
	size_t sz, cnt, rs, prefixlen, pairlen;
	int attrnamespace, error;

	if (args->path == NULL) {
		error = getvnode(td, args->fd,
		    cap_rights_init_one(&rights, CAP_EXTATTR_LIST), &fp);
		if (error != 0)
			return (error);
	}

	if (args->size != 0)
		sz = min(LINUX_XATTR_LIST_MAX, args->size);
	else
		sz = LINUX_XATTR_LIST_MAX;

	data = malloc(sz, M_LINUX, M_WAITOK);
	auio.uio_iov = &aiov;
	auio.uio_iovcnt = 1;
	auio.uio_rw = UIO_READ;
	auio.uio_segflg = UIO_SYSSPACE;
	auio.uio_td = td;
	cnt = 0;
	for (attrnamespace = EXTATTR_NAMESPACE_USER;
	    attrnamespace < nitems(extattr_namespace_names);
	    attrnamespace++) {
		aiov.iov_base = data;
		aiov.iov_len = sz;
		auio.uio_resid = sz;
		auio.uio_offset = 0;

		if (args->path != NULL)
			error = kern_extattr_list_path(td, args->path,
			    attrnamespace, &auio, args->follow, UIO_USERSPACE);
		else
			error = kern_extattr_list_fp(td, fp,
			    attrnamespace, &auio);
		rs = sz - auio.uio_resid;
		if (error == EPERM)
			break;
		if (error != 0 || rs == 0)
			continue;
		prefix = extattr_namespace_names[attrnamespace];
		prefixlen = strlen(prefix);
		key = data;
		while (rs > 0) {
			keylen = (unsigned char)key[0];
			pairlen = prefixlen + 1 + keylen + 1;
			cnt += pairlen;
			if (cnt > LINUX_XATTR_LIST_MAX) {
				error = E2BIG;
				break;
			}
			/*
			 * If size is specified as zero, return the current size
			 * of the list of extended attribute names.
			 */
			if ((args->size > 0 && cnt > args->size) ||
			    pairlen >= sizeof(attrname)) {
				error = ERANGE;
				break;
			}
			++key;
			if (args->list != NULL && args->size > 0) {
				sprintf(attrname, "%s.%.*s", prefix, keylen, key);
				error = copyout(attrname, args->list, pairlen);
				if (error != 0)
					break;
				args->list += pairlen;
			}
			key += keylen;
			rs -= (keylen + 1);
		}
	}
	if (error == 0)
		td->td_retval[0] = cnt;
	free(data, M_LINUX);
	if (fp != NULL)
		fdrop(fp, td);
	return (error_to_xattrerror(attrnamespace, error));
}

int
linux_listxattr(struct thread *td, struct linux_listxattr_args *args)
{
	struct listxattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.list = args->list,
		.size = args->size,
		.follow = FOLLOW,
	};

	return (listxattr(td, &eargs));
}

int
linux_llistxattr(struct thread *td, struct linux_llistxattr_args *args)
{
	struct listxattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.list = args->list,
		.size = args->size,
		.follow = NOFOLLOW,
	};

	return (listxattr(td, &eargs));
}

int
linux_flistxattr(struct thread *td, struct linux_flistxattr_args *args)
{
	struct listxattr_args eargs = {
		.fd = args->fd,
		.path = NULL,
		.list = args->list,
		.size = args->size,
		.follow = 0,
	};

	return (listxattr(td, &eargs));
}

static int
removexattr(struct thread *td, struct removexattr_args *args)
{
	char attrname[LINUX_XATTR_NAME_MAX + 1];
	struct file *fp = NULL;
	cap_rights_t rights;
	int attrnamespace, error;

	if (args->path == NULL) {
		error = getvnode(td, args->fd,
		    cap_rights_init_one(&rights, CAP_EXTATTR_DELETE), &fp);
		if (error != 0)
			return (error);
	}

	error = xattr_to_extattr(args->name, &attrnamespace, attrname);
	if (error != 0)
		goto out_err;
	if (args->path != NULL)
		error = kern_extattr_delete_path(td, args->path, attrnamespace,
		    attrname, args->follow, UIO_USERSPACE);
	else
		error = kern_extattr_delete_fp(td, fp, attrnamespace,
		    attrname);
	if (fp != NULL)
		fdrop(fp, td);
	return (error_to_xattrerror(attrnamespace, error));
out_err:
	if (fp != NULL)
		fdrop(fp, td);
	return (error);
}

int
linux_removexattr(struct thread *td, struct linux_removexattr_args *args)
{
	struct removexattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.name = args->name,
		.follow = FOLLOW,
	};

	return (removexattr(td, &eargs));
}

int
linux_lremovexattr(struct thread *td, struct linux_lremovexattr_args *args)
{
	struct removexattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.name = args->name,
		.follow = NOFOLLOW,
	};

	return (removexattr(td, &eargs));
}

int
linux_fremovexattr(struct thread *td, struct linux_fremovexattr_args *args)
{
	struct removexattr_args eargs = {
		.fd = args->fd,
		.path = NULL,
		.name = args->name,
		.follow = 0,
	};

	return (removexattr(td, &eargs));
}

/*-
 * Linux-specific atomic extended attribute get on a vnode.
 *
 * Probes the attribute size and reads the data under a single vnode lock,
 * preventing a TOCTOU race and returning ERANGE when the buffer is too
 * small (matching Linux getxattr(2) semantics).
 */
static int
linux_extattr_get_vp(struct vnode *vp, int attrnamespace, const char *attrname,
    void *data, size_t nbytes, struct thread *td)
{
	struct uio auio;
	struct iovec aiov;
	size_t size;
	int error;

	if (nbytes > IOSIZE_MAX)
		return (EINVAL);

	vn_lock(vp, LK_SHARED | LK_RETRY);

#ifdef MAC
	error = mac_vnode_check_getextattr(td->td_ucred, vp, attrnamespace,
	    attrname);
	if (error != 0)
		goto done;
#endif

	/*
	 * Probe the attribute size first under the vnode lock;
	 */
	error = VOP_GETEXTATTR(vp, attrnamespace, attrname, NULL,
	    &size, td->td_ucred, td);
	if (error != 0)
		goto done;

	/*
	 * The caller only wants the size, so we are done after this.
	 */
	if (data == NULL || nbytes == 0) {
		td->td_retval[0] = size;
		goto done;
	}
	/*
	 * If the buffer is too small, return ERANGE
	 * so the caller can retry (Linux getxattr semantics).
	 */
	if (size > nbytes) {
		error = ERANGE;
		goto done;
	}
	/* Buffer is large enough; read the value. */
	aiov.iov_base = data;
	aiov.iov_len = nbytes;
	auio.uio_iov = &aiov;
	auio.uio_iovcnt = 1;
	auio.uio_offset = 0;
	auio.uio_resid = nbytes;
	auio.uio_rw = UIO_READ;
	auio.uio_segflg = UIO_USERSPACE;
	auio.uio_td = td;
	error = VOP_GETEXTATTR(vp, attrnamespace, attrname, &auio, NULL,
		td->td_ucred, td);
	if (error == 0)
		td->td_retval[0] = nbytes - auio.uio_resid;
done:
	VOP_UNLOCK(vp);
	return (error);
}

static int
getxattr(struct thread *td, struct getxattr_args *args)
{
	char attrname[LINUX_XATTR_NAME_MAX + 1];
	struct file *fp = NULL;
	struct nameidata nd;
	struct vnode *vp;
	cap_rights_t rights;
	int attrnamespace, error;

	if (args->path == NULL) {
		error = getvnode(td, args->fd,
		    cap_rights_init_one(&rights, CAP_EXTATTR_GET), &fp);
		if (error != 0)
			return (error);
		vp = fp->f_vnode;
	} else {
		NDINIT_ATRIGHTS(&nd, LOOKUP, args->follow, UIO_USERSPACE,
		    args->path, AT_FDCWD,
		    cap_rights_init_one(&rights, CAP_EXTATTR_GET));
		error = namei(&nd);
		if (error != 0)
			return (error);
		NDFREE_PNBUF(&nd);
		vp = nd.ni_vp;
	}

	error = xattr_to_extattr(args->name, &attrnamespace, attrname);
	if (error == 0) {
		error = linux_extattr_get_vp(vp, attrnamespace, attrname,
			args->value, args->size, td);
	}

	if (fp != NULL) {
		fdrop(fp, td);
	} else {
		vrele(nd.ni_vp);
	}
	return (error == EPERM || error == EOPNOTSUPP ? ENOATTR : error);
}

int
linux_getxattr(struct thread *td, struct linux_getxattr_args *args)
{
	struct getxattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.name = args->name,
		.value = args->value,
		.size = args->size,
		.follow = FOLLOW,
	};

	return (getxattr(td, &eargs));
}

int
linux_lgetxattr(struct thread *td, struct linux_lgetxattr_args *args)
{
	struct getxattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.name = args->name,
		.value = args->value,
		.size = args->size,
		.follow = NOFOLLOW,
	};

	return (getxattr(td, &eargs));
}

int
linux_fgetxattr(struct thread *td, struct linux_fgetxattr_args *args)
{
	struct getxattr_args eargs = {
		.fd = args->fd,
		.path = NULL,
		.name = args->name,
		.value = args->value,
		.size = args->size,
		.follow = 0,
	};

	return (getxattr(td, &eargs));
}

static int
setxattr(struct thread *td, struct setxattr_args *args)
{
	char attrname[LINUX_XATTR_NAME_MAX + 1];
	struct file *fp = NULL;
	cap_rights_t rights;
	int attrnamespace, error;

	if (args->path == NULL) {
		if ((args->flags & LINUX_XATTR_FLAGS) != 0)
			cap_rights_init(&rights, CAP_EXTATTR_GET, CAP_EXTATTR_SET);
		else
			cap_rights_init_one(&rights, CAP_EXTATTR_SET);
		error = getvnode(td, args->fd, &rights, &fp);
		if (error != 0)
			return (error);
	}

	if ((args->flags & ~LINUX_XATTR_FLAGS) != 0 ||
	    args->flags == LINUX_XATTR_FLAGS) {
		error = EINVAL;
		goto out_err;
	}
	error = xattr_to_extattr(args->name, &attrnamespace, attrname);
	if (error != 0)
		goto out_err;

	if ((args->flags & LINUX_XATTR_FLAGS) != 0) {
		if (args->path != NULL)
			error = kern_extattr_get_path(td, args->path,
			    attrnamespace, attrname, NULL, args->size,
			    args->follow, UIO_USERSPACE);
		else
			error = kern_extattr_get_fp(td, fp,
			    attrnamespace, attrname, NULL, args->size);
		if ((args->flags & LINUX_XATTR_CREATE) != 0) {
			if (error == 0)
				error = EEXIST;
			else if (error == ENOATTR)
				error = 0;
		}
		if (error != 0)
			goto out;
	}
	if (args->path != NULL)
		error = kern_extattr_set_path(td, args->path, attrnamespace,
		    attrname, args->value, args->size, args->follow,
		    UIO_USERSPACE);
	else
		error = kern_extattr_set_fp(td, fp, attrnamespace,
		    attrname, args->value, args->size);
out:
	if (fp != NULL)
		fdrop(fp, td);
	td->td_retval[0] = 0;
	return (error_to_xattrerror(attrnamespace, error));
out_err:
	if (fp != NULL)
		fdrop(fp, td);
	return (error);
}

int
linux_setxattr(struct thread *td, struct linux_setxattr_args *args)
{
	struct setxattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.name = args->name,
		.value = args->value,
		.size = args->size,
		.flags = args->flags,
		.follow = FOLLOW,
	};

	return (setxattr(td, &eargs));
}

int
linux_lsetxattr(struct thread *td, struct linux_lsetxattr_args *args)
{
	struct setxattr_args eargs = {
		.fd = -1,
		.path = args->path,
		.name = args->name,
		.value = args->value,
		.size = args->size,
		.flags = args->flags,
		.follow = NOFOLLOW,
	};

	return (setxattr(td, &eargs));
}

int
linux_fsetxattr(struct thread *td, struct linux_fsetxattr_args *args)
{
	struct setxattr_args eargs = {
		.fd = args->fd,
		.path = NULL,
		.name = args->name,
		.value = args->value,
		.size = args->size,
		.flags = args->flags,
		.follow = 0,
	};

	return (setxattr(td, &eargs));
}