#include <ssl_service_cache.h>
#include <MESA/maat.h>
#include <tfe_resource.h>
#include <ssl_stream.h>

struct ssl_svc_ja3
{
    char ja3_hash[33];
    int fingerprint_id;
	int pinning_state;
    int is_valid;
    int ref_cnt;
};

struct ssl_svc_addr
{
	const char *sip;
	const char *sport;
	const char *dip;
	const char *dport;
};

static int table_id = 0;

static void ssl_svc_ja3_param_dup_cb(int table_id, void **to, void **from, long argl, void *argp)
{
    struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*from;
    if (param)
    {
        __sync_add_and_fetch(&(param->ref_cnt), 1);
        *to = param;
    }
    else
    {
        *to = NULL;
    }
    return;
}

static void ssl_svc_ja3_param_new_cb(const char *table_name, int table_id, const char *key, const char *table_line, void **ad, long argl, void *argp)
{
    int is_valid = 0;
    int pinning_state = 0;
    int fingerprint_id = 0;
    char ja3_hash[33] = {0};

    if (sscanf(table_line, "%d\t%s\t%d\t%d", &fingerprint_id, ja3_hash, &pinning_state, &is_valid) != 4)
    {
        TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: %s", table_line);
        return;
    }

    struct ssl_svc_ja3 *param = ALLOC(struct ssl_svc_ja3, 1);
    param->fingerprint_id = fingerprint_id;
    memcpy(param->ja3_hash, ja3_hash, 32);
    param->pinning_state = pinning_state;
    param->is_valid = is_valid;
    param->ref_cnt = 1;

    *ad = param;
    TFE_LOG_INFO(g_default_logger, "Add JA3 policy: id:%d, ja3_hash:%s, pinning_state:%d, is_valid:%d, ref_cnt:%d",
                 param->fingerprint_id, param->ja3_hash, param->pinning_state, param->is_valid, param->ref_cnt);
}

static void ssl_svc_ja3_param_free_cb(int table_id, void **ad, long argl, void *argp)
{
    struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*ad;
    if (param == NULL)
    {
        return;
    }

    if ((__sync_sub_and_fetch(&param->ref_cnt, 1) == 0))
    {
        TFE_LOG_INFO(g_default_logger, "Del JA3 policy: id:%d, ja3_hash:%s, pinning_state:%d, is_valid:%d, ref_cnt:%d",
                     param->fingerprint_id, param->ja3_hash, param->pinning_state, param->is_valid, param->ref_cnt);
        free(param);
        *ad = NULL;
    }
}

static void ssl_svc_ja3_param_free(struct ssl_svc_ja3 *param)
{
    ssl_svc_ja3_param_free_cb(0, (void **)&param, 0, NULL);
    return;
}

static int ssl_svc_ja3_init(const char *table_name)
{
    table_id = maat_get_table_id(tfe_get_maat_handle(), table_name);
    if (table_id < 0)
    {
        TFE_LOG_ERROR(g_default_logger, "Maat table %s register failed.", table_name);
        return 0;
    }
    int ret = maat_plugin_table_ex_schema_register(tfe_get_maat_handle(),
                                     	 		table_name,
                                      			ssl_svc_ja3_param_new_cb,
                                      			ssl_svc_ja3_param_free_cb,
                                      			ssl_svc_ja3_param_dup_cb,
                                      			0,
                                      			NULL);
    if (ret < 0)
    {
        TFE_LOG_ERROR(g_default_logger, "failed at Maat_plugin_EX_register(%s), table_id = %d, ret = %d",
                      table_name, table_id, ret);
        return 0;
    }

    return 1;
}

enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, const char *addr_str)
{
    enum ssl_ja3_pinning_status ret = JA3_PINNING_STATUS_UNKNOWN;
    struct ssl_svc_ja3 *param = NULL;

    param = (struct ssl_svc_ja3 *)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), table_id, ja3_hash, strlen(ja3_hash));
    if (param == NULL)
    {
        ret = JA3_PINNING_STATUS_UNKNOWN;
        goto end;
    }
    TFE_LOG_INFO(g_default_logger, "Hit JA3 policy: id:%d, ja3_hash:%s, pinning_state:%d, is_valid:%d, ref_cnt:%d, addr:%s",
                 param->fingerprint_id, param->ja3_hash, param->pinning_state, param->is_valid, param->ref_cnt, addr_str);

    if (!param->is_valid)
    {
        ret = JA3_PINNING_STATUS_UNKNOWN;
        goto end;
    }

	// 1 - pinning
    if (param->pinning_state)
    {
        ret = JA3_PINNING_STATUS_IS_PINNING;
    }
    // 0 - not pinning
    else
	{
        ret = JA3_PINNING_STATUS_NOT_PINNING;
    }

end:
    if (param)
    {
        ssl_svc_ja3_param_free(param);
        param = NULL;
    }

    return ret;
}

struct ssl_svc_client_st
{
	time_t last_update_time;
	unsigned int suspect_pinning_count;	
	unsigned int protocol_error_count;
	char is_mutual_auth;
	struct ssl_service_cache* ref_svc_cache;
};
struct ssl_svc_server_st
{
	char is_ev;
	char is_ct;
	long long ev_st_switched;
	long long ct_st_switched;
	struct ssl_service_cache* ref_svc_cache;
};
struct ssl_service_write_args
{
	struct ssl_service_cache* cache;
	const struct ssl_service_status* status;
};
static void ssl_svc_free_client_st(void * data)
{
	struct ssl_svc_client_st* p = (struct ssl_svc_client_st *) data;
	struct ssl_service_cache* svc_cache=p->ref_svc_cache;
	if(p->is_mutual_auth)
	{
		svc_cache->stat.mutual_auth_cli_cnt--;
	}
	if(p->suspect_pinning_count>=svc_cache->fail_as_cli_pinning_count)
	{
		svc_cache->stat.pinning_cli_cnt--;
	}

	if (p->protocol_error_count >= svc_cache->fail_as_proto_err_count)
	{
		svc_cache->stat.proto_err_cli_cnt--;
	}

	free(p);
	return;
}
static void ssl_svc_free_server_st(void * data)
{
	struct ssl_svc_server_st* p = (struct ssl_svc_server_st *) data;
	struct ssl_service_cache* svc_cache=p->ref_svc_cache;
	if(p->is_ct)
	{
		svc_cache->stat.ct_srv_cnt--;
	}
	if(p->is_ev)
	{
		svc_cache->stat.ev_srv_cnt--;
	}
	free(p);
	return;
}
static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello,  const struct tfe_stream *tcp_stream, char* key_buff, size_t sz)
{
	size_t key_len=0;
	key_len=snprintf(key_buff, sz, "%s:%s:%s:", addr_info->dip, addr_info->dport, chello->sni ? chello->sni : "null");
	return key_len;
}
static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
    char ja3_val[64] = {0};
    uint16_t ja3_len = 0;
    size_t key_len = 0;
    struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
    if (cmsg != NULL)
    {
        int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
        if (ret != 0)
        {
            TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), tcp_stream->str_stream_info);
        }
		else
		{
            TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, tcp_stream->str_stream_info);
        }	
    }

    // If ja3 is successfully obtained, use ja3 to generate hashkey
    if (strlen(ja3_val))
    {
        key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : addr_info->dip);
        return key_len;
    }

    // otherwise, splicing ssl attributes to generate hashkey
    key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, 
												chello->max_version.ossl_format,
												chello->sni?chello->sni: addr_info->dip ,
												chello->alpn?chello->alpn:"null");
	if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
	{
		memcpy(key_buff+key_len, chello->cipher_suites, chello->cipher_suites_len);
		key_len+=chello->cipher_suites_len;
	}
	if(chello->sign_algos && sz-key_len > chello->sign_algos_len)
	{
		memcpy(key_buff+key_len, chello->sign_algos, chello->sign_algos_len);
		key_len+=chello->sign_algos_len;
	}
	if(chello->supported_groups && sz-key_len > chello->supported_groups_len)
	{
		memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
		key_len+=chello->supported_groups_len;
	}
	return key_len;
}
static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
	size_t key_len=0;
	char chello_id_buff[sz];
	size_t chello_id_len=0;

	key_len=snprintf(key_buff, sz, "%s:", addr_info->sip);
    chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
    memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
	key_len += MIN(chello_id_len, sz-key_len);

	return key_len;
}
static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
{
	struct ssl_svc_client_st* cli_st=(struct ssl_svc_client_st*)data;
	struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
	
	if (cli_st == NULL)
	{
		return 0;
	}
	struct ssl_service_cache* svc_cache=cli_st->ref_svc_cache;
	if(cli_st->suspect_pinning_count==0)
	{		
		result->cli_pinning_status=PINNING_ST_NOT_PINNING;
	}
	else if(cli_st->suspect_pinning_count<svc_cache->fail_as_cli_pinning_count)
	{
		result->cli_pinning_status=PINNING_ST_MAYBE_PINNING;
	}
	else
	{
		result->cli_pinning_status=PINNING_ST_PINNING;
	}
	if(cli_st->protocol_error_count>=svc_cache->fail_as_proto_err_count)
	{
		result->has_protocol_errors=1;
	}
	result->is_mutual_auth=cli_st->is_mutual_auth;
	return 1;
}
static long cli_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
{
	struct ssl_svc_client_st* cli_st=(struct ssl_svc_client_st*)data;
	struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg;
	const struct ssl_service_status* status=args->status;
	struct ssl_service_cache* cache=args->cache;
	UNUSED int ret = 0;
	time_t now=time(NULL);
	if(cli_st==NULL)
	{
		cli_st=ALLOC(struct ssl_svc_client_st, 1);
		cli_st->ref_svc_cache=cache;
		cli_st->last_update_time = now;
		ret = MESA_htable_add(cache->cli_st_hash, key, size, cli_st);
		assert(ret >= 0);
	}
	if (now - cli_st->last_update_time > cache->fail_time_window)
	{
		if(cli_st->suspect_pinning_count<cache->fail_as_cli_pinning_count)	cli_st->suspect_pinning_count=0;
		if(cli_st->protocol_error_count<cache->fail_as_proto_err_count)	cli_st->protocol_error_count=0;
		cli_st->last_update_time = now;
	}
	if(status->cli_pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_cli_pinning_count)
	{
		if(status->cli_pinning_status==PINNING_ST_PINNING)
		{
			cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count;
		}
		else
		{
			cli_st->suspect_pinning_count++;
		}
		if(cli_st->suspect_pinning_count==cache->fail_as_cli_pinning_count)
		{
			cache->stat.pinning_cli_cnt++;
		}
	}
	else if(status->cli_pinning_status==PINNING_ST_PINNING)
	{
		cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count;
	}
	if(status->has_protocol_errors)
	{
		cli_st->protocol_error_count++;
		if(cli_st->protocol_error_count==cache->fail_as_proto_err_count)
		{
			cache->stat.proto_err_cli_cnt++;
		}
	}
	if(status->is_mutual_auth==1&&cli_st->is_mutual_auth==0)
	{
		cache->stat.mutual_auth_cli_cnt++;	
		cli_st->is_mutual_auth=1;
	}
	cli_st->last_update_time=now;	
	return 1;
}

static long srv_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
{
	struct ssl_svc_server_st* srv_st=(struct ssl_svc_server_st*)data;
	struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
	if (srv_st == NULL)
	{
		return 0;
	}
	result->is_ct=srv_st->is_ct;
	result->is_ev=srv_st->is_ev;
	return 1;
}
static long srv_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
{
	struct ssl_svc_server_st* srv_st=(struct ssl_svc_server_st*)data;
	struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg;
	const struct ssl_service_status* status=args->status;
	struct ssl_service_cache* cache=args->cache;
	UNUSED int ret = 0;
	if(srv_st==NULL)
	{
		srv_st=ALLOC(struct ssl_svc_server_st, 1);
		srv_st->ref_svc_cache=cache;
		ret = MESA_htable_add(cache->srv_st_hash, key, size, srv_st);
		assert(ret >= 0);
	}
	if(status->is_ev==1&&srv_st->is_ev==0)
	{
		srv_st->is_ev=1;
		cache->stat.ev_srv_cnt++;
	}
	if(status->is_ev!=srv_st->is_ev)
	{
		srv_st->ev_st_switched++;
	}
	if(status->is_ct==1&&srv_st->is_ct==0)
	{
		srv_st->is_ct=1;
		cache->stat.ct_srv_cnt++;
	}
	if(status->is_ct!=srv_st->is_ct)
	{
		srv_st->ct_st_switched++;
	}
//	assert(srv_st->ev_st_switched<2&&srv_st->ct_st_switched<2);
	return 1;
}

int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result)
{
	long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
	char temp_key[2048];
	unsigned char hash_key[4096]; // Size must be twice the size of temp_key
	size_t temp_key_sz=0;
	size_t hash_key_sz=0;
	if(chello->sni==NULL)
	{
		return 0;
	}

	struct ssl_svc_addr addr_info = { NULL, NULL, NULL, NULL};
 	char *addr_str = tfe_strdup(tcp_stream->str_stream_info);
    tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));

	memset(hash_key, 0, sizeof(hash_key));
    temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
    hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
	MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
	TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%ld, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
				hash_key, cli_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);

	memset(hash_key, 0, sizeof(hash_key));
    temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
    hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
	MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
	TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%ld, sni:%s, addr:%s, ct:%d, ev:%d",
				hash_key, svr_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_ct, result->is_ev);

    char ja3_hash[64] = {0};
    uint16_t ja3_len = 0;
    result->ja3_pinning_status = JA3_PINNING_STATUS_UNKNOWN;
    struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
    if (cmsg)
    {
        int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_hash, sizeof(ja3_hash), &ja3_len);
        if (ret == 0)
        {
            result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, tcp_stream->str_stream_info);
            if (result->ja3_pinning_status != JA3_PINNING_STATUS_UNKNOWN)
			{
                app_st_cb_ret = 1;
            }
        }
    }
    TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, ja3_pinning_status:%d",
                  ja3_hash, app_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->ja3_pinning_status);

    free(addr_str);

    if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
	{
		return 1;
	}
	else
	{
		return 0;
	}
}

void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, const struct ssl_service_status *status)
{
	long cli_st_cb_ret=0, svr_st_cb_ret=0;
	char temp_key[2048];
	unsigned char hash_key[4096]; // Size must be twice the size of temp_key
	size_t temp_key_sz=0;
	size_t hash_key_sz=0;

	if(chello == NULL || chello->sni==NULL)
	{
		return;
	}

	struct ssl_svc_addr addr_info = { NULL, NULL, NULL, NULL};
 	char *addr_str = tfe_strdup(tcp_stream->str_stream_info);
    tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));

    struct ssl_service_write_args write_args={svc_cache, status};
	if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
	{
		memset(hash_key, 0, sizeof(hash_key));
        temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
        hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
        TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
                      hash_key, chello->sni, tcp_stream->str_stream_info, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
        MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
	}
	if(status->is_ct||status->is_ev)
	{	
		memset(hash_key, 0, sizeof(hash_key));
        temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
        hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
        TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
                      hash_key, chello->sni, tcp_stream->str_stream_info, status->is_ct, status->is_ev);
        MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
	}

	free(addr_str);
}
struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win
, char *ja3_table_name)
{
    if (ssl_svc_ja3_init(ja3_table_name) == 0)
    {
        return NULL;
    }

    struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
	unsigned max_num = slot_size * 4;
	UNUSED int ret = 0;
	MESA_htable_handle htable=NULL, saved[3];
	int i=0, opt_val=0;
	cache->fail_as_cli_pinning_count=fail_as_pinning_cnt;
	cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
	cache->fail_time_window=fail_time_win;
	void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
	for(i=0; i<2; i++)
	{
		htable = MESA_htable_born();
		opt_val=0;
		ret = MESA_htable_set_opt(htable, MHO_SCREEN_PRINT_CTRL, &opt_val, sizeof(opt_val));
		opt_val=1;
		ret = MESA_htable_set_opt(htable, MHO_THREAD_SAFE, &opt_val, sizeof(opt_val));
		opt_val=16;
		ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val));
		ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size));
		ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num));
		// for client table and server table
		ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
		opt_val = HASH_ELIMINATE_ALGO_FIFO;
		ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));

		ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE,
			(void*)free_func[i], sizeof(free_func[i]));
		
		ret = MESA_htable_mature(htable);
		assert(ret == 0);
		saved[i]=htable;
	}
	cache->cli_st_hash=saved[0];
	cache->srv_st_hash=saved[1];
	
    return cache;
}
void ssl_service_cache_destroy(struct ssl_service_cache* cache)
{
	MESA_htable_destroy(cache->cli_st_hash, NULL);
	cache->cli_st_hash=NULL;
	MESA_htable_destroy(cache->srv_st_hash, NULL);
	cache->srv_st_hash=NULL;
	free(cache);
	return;
}
void ssl_service_cache_stat(struct ssl_service_cache* svc_cache, struct ssl_service_cache_statistics* result)
{
	*result=svc_cache->stat;
	return;
}