/* SPDX-License-Identifier: GPL-2.0-or-later */

#include <errno.h>
#include <fcntl.h>
#include <stdbool.h>
#include <stddef.h>
#include <sys/stat.h>
#include <unistd.h>

#include "sd-id128.h"

#include "alloc-util.h"
#include "device-private.h"
#include "device-util.h"
#include "dirent-util.h"
#include "fd-util.h"
#include "format-util.h"
#include "fs-util.h"
#include "hexdecoct.h"
#include "mkdir.h"
#include "parse-util.h"
#include "path-util.h"
#include "random-util.h"
#include "selinux-util.h"
#include "smack-util.h"
#include "stat-util.h"
#include "stdio-util.h"
#include "string-util.h"
#include "strxcpyx.h"
#include "time-util.h"
#include "udev-node.h"
#include "user-util.h"

#define CREATE_LINK_MAX_RETRIES        128
#define LINK_UPDATE_MAX_RETRIES        128
#define CREATE_STACK_LINK_MAX_RETRIES  128
#define UPDATE_TIMESTAMP_MAX_RETRIES   128
#define MAX_RANDOM_DELAY (250 * USEC_PER_MSEC)
#define MIN_RANDOM_DELAY ( 50 * USEC_PER_MSEC)
#define UDEV_NODE_HASH_KEY SD_ID128_MAKE(b9,6a,f1,ce,40,31,44,1a,9e,19,ec,8b,ae,f3,e3,2f)

static int create_symlink(const char *target, const char *slink) {
        int r;

        assert(target);
        assert(slink);

        for (unsigned i = 0; i < CREATE_LINK_MAX_RETRIES; i++) {
                r = mkdir_parents_label(slink, 0755);
                if (r == -ENOENT)
                        continue;
                if (r < 0)
                        return r;

                mac_selinux_create_file_prepare(slink, S_IFLNK);
                if (symlink(target, slink) < 0)
                        r = -errno;
                else
                        r = 0;
                mac_selinux_create_file_clear();
                if (r != -ENOENT)
                        return r;
        }

        return r;
}

static int node_symlink(sd_device *dev, const char *node, const char *slink) {
        _cleanup_free_ char *slink_dirname = NULL, *target = NULL;
        const char *id, *slink_tmp;
        struct stat stats;
        int r;

        assert(dev);
        assert(node);
        assert(slink);

        if (lstat(slink, &stats) >= 0) {
                if (!S_ISLNK(stats.st_mode))
                        return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EEXIST),
                                                      "Conflicting inode '%s' found, link to '%s' will not be created.", slink, node);
        } else if (errno != ENOENT)
                return log_device_debug_errno(dev, errno, "Failed to lstat() '%s': %m", slink);

        r = path_extract_directory(slink, &slink_dirname);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get parent directory of '%s': %m", slink);

        /* use relative link */
        r = path_make_relative(slink_dirname, node, &target);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get relative path from '%s' to '%s': %m", slink, node);

        r = device_get_device_id(dev, &id);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get device id: %m");

        slink_tmp = strjoina(slink, ".tmp-", id);
        (void) unlink(slink_tmp);

        r = create_symlink(target, slink_tmp);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to create symlink '%s' to '%s': %m", slink_tmp, target);

        if (rename(slink_tmp, slink) < 0) {
                r = log_device_debug_errno(dev, errno, "Failed to rename '%s' to '%s': %m", slink_tmp, slink);
                (void) unlink(slink_tmp);
                return r;
        }

        return 0;
}

static int link_find_prioritized(sd_device *dev, bool add, const char *stackdir, char **ret) {
        _cleanup_closedir_ DIR *dir = NULL;
        _cleanup_free_ char *target = NULL;
        struct dirent *dent;
        int r, priority = 0;
        const char *id;

        assert(dev);
        assert(stackdir);
        assert(ret);

        /* Find device node of device with highest priority. This returns 1 if a device found, 0 if no
         * device found, or a negative errno. */

        if (add) {
                const char *devnode;

                r = device_get_devlink_priority(dev, &priority);
                if (r < 0)
                        return r;

                r = sd_device_get_devname(dev, &devnode);
                if (r < 0)
                        return r;

                target = strdup(devnode);
                if (!target)
                        return -ENOMEM;
        }

        dir = opendir(stackdir);
        if (!dir) {
                if (add) /* The stack directory must exist. */
                        return -errno;
                if (errno != ENOENT)
                        return -errno;

                *ret = NULL;
                return 0;
        }

        r = device_get_device_id(dev, &id);
        if (r < 0)
                return r;

        FOREACH_DIRENT_ALL(dent, dir, break) {
                _cleanup_free_ char *path = NULL, *buf = NULL;
                int tmp_prio;

                if (dent->d_name[0] == '.')
                        continue;

                /* skip ourself */
                if (streq(dent->d_name, id))
                        continue;

                path = path_join(stackdir, dent->d_name);
                if (!path)
                        return -ENOMEM;

                if (readlink_malloc(path, &buf) >= 0) {
                        char *devnode;

                        /* New format. The devnode and priority can be obtained from symlink. */

                        devnode = strchr(buf, ':');
                        if (!devnode || devnode == buf)
                                continue;

                        *(devnode++) = '\0';
                        if (!path_startswith(devnode, "/dev"))
                                continue;

                        if (safe_atoi(buf, &tmp_prio) < 0)
                                continue;

                        if (target && tmp_prio <= priority)
                                continue;

                        r = free_and_strdup(&target, devnode);
                        if (r < 0)
                                return r;
                } else {
                        _cleanup_(sd_device_unrefp) sd_device *tmp_dev = NULL;
                        const char *devnode;

                        /* Old format. The devnode and priority must be obtained from uevent and
                         * udev database files. */

                        if (sd_device_new_from_device_id(&tmp_dev, dent->d_name) < 0)
                                continue;

                        if (device_get_devlink_priority(tmp_dev, &tmp_prio) < 0)
                                continue;

                        if (target && tmp_prio <= priority)
                                continue;

                        if (sd_device_get_devname(tmp_dev, &devnode) < 0)
                                continue;

                        r = free_and_strdup(&target, devnode);
                        if (r < 0)
                                return r;
                }

                priority = tmp_prio;
        }

        *ret = TAKE_PTR(target);
        return !!*ret;
}

size_t udev_node_escape_path(const char *src, char *dest, size_t size) {
        size_t i, j;
        uint64_t h;

        assert(src);
        assert(dest);
        assert(size >= 12);

        for (i = 0, j = 0; src[i] != '\0'; i++) {
                if (src[i] == '/') {
                        if (j+4 >= size - 12 + 1)
                                goto toolong;
                        memcpy(&dest[j], "\\x2f", 4);
                        j += 4;
                } else if (src[i] == '\\') {
                        if (j+4 >= size - 12 + 1)
                                goto toolong;
                        memcpy(&dest[j], "\\x5c", 4);
                        j += 4;
                } else {
                        if (j+1 >= size - 12 + 1)
                                goto toolong;
                        dest[j] = src[i];
                        j++;
                }
        }
        dest[j] = '\0';
        return j;

toolong:
        /* If the input path is too long to encode as a filename, then let's suffix with a string
         * generated from the hash of the path. */

        h = siphash24_string(src, UDEV_NODE_HASH_KEY.bytes);

        for (unsigned k = 0; k <= 10; k++)
                dest[size - k - 2] = urlsafe_base64char((h >> (k * 6)) & 63);

        dest[size - 1] = '\0';
        return size - 1;
}

static int update_timestamp(sd_device *dev, const char *path, struct stat *prev) {
        assert(path);
        assert(prev);

        /* Even if a symlink in the stack directory is created/removed, the mtime of the directory may
         * not be changed. Why? Let's consider the following situation. For simplicity, let's assume
         * there exist two udev workers (A and B) and all of them calls link_update() for the same
         * devlink simultaneously.
         *
         * 1. A creates/removes a symlink in the stack directory.
         * 2. A calls the first stat() in the loop of link_update().
         * 3. A calls link_find_prioritized().
         * 4. B creates/removes another symlink in the stack directory, so the result of the step 3 is outdated.
         * 5. B finishes link_update().
         * 6. A creates/removes devlink according to the outdated result in the step 3.
         * 7. A calls the second stat() in the loop of link_update().
         *
         * If these 7 steps are processed in this order within a short time period that kernel's timer
         * does not increase, then even if the contents in the stack directory is changed, the results
         * of two stat() called by A shows the same timestamp, and A cannot detect the change.
         *
         * By calling this function after creating/removing symlinks in the stack directory, the
         * timestamp of the stack directory is always increased at least in the above step 5, so A can
         * detect the update. */

        if ((prev->st_mode & S_IFMT) == 0)
                return 0; /* Does not exist, or previous stat() failed. */

        for (unsigned i = 0; i < UPDATE_TIMESTAMP_MAX_RETRIES; i++) {
                struct stat st;

                if (stat(path, &st) < 0)
                        return -errno;

                if (!stat_inode_unmodified(prev, &st))
                        return 0;

                log_device_debug(dev,
                                 "%s is modified, but its timestamp is not changed, "
                                 "updating timestamp after 10ms.",
                                 path);

                (void) usleep(10 * USEC_PER_MSEC);
                if (utimensat(AT_FDCWD, path, NULL, 0) < 0)
                        return -errno;
        }

        return -ELOOP;
}

static int update_stack_directory(sd_device *dev, const char *dirname, bool add) {
        _cleanup_free_ char *filename = NULL, *data = NULL, *buf = NULL;
        const char *devname, *id;
        struct stat st = {};
        int priority, r;

        assert(dev);
        assert(dirname);

        r = device_get_device_id(dev, &id);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get device id: %m");

        filename = path_join(dirname, id);
        if (!filename)
                return log_oom_debug();

        if (!add) {
                int unlink_error = 0, stat_error = 0;

                if (stat(dirname, &st) < 0) {
                        if (errno == ENOENT)
                                return 0; /* The stack directory is already removed. That's OK. */
                        stat_error = -errno;
                }

                if (unlink(filename) < 0)
                        unlink_error = -errno;

                if (rmdir(dirname) >= 0 || errno == ENOENT)
                        return 0;

                if (unlink_error < 0) {
                        if (unlink_error == -ENOENT)
                                return 0;

                        /* If we failed to remove the symlink, then there is almost nothing we can do. */
                        return log_device_debug_errno(dev, unlink_error, "Failed to remove %s: %m", filename);
                }

                if (stat_error < 0)
                        return log_device_debug_errno(dev, stat_error, "Failed to stat %s: %m", dirname);

                /* The symlink was removed. Check if the timestamp of directory is changed. */
                r = update_timestamp(dev, dirname, &st);
                if (r < 0 && r != -ENOENT)
                        return log_device_debug_errno(dev, r, "Failed to update timestamp of %s: %m", dirname);

                return 0;
        }

        r = sd_device_get_devname(dev, &devname);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get device node: %m");

        r = device_get_devlink_priority(dev, &priority);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get priority of device node symlink: %m");

        if (asprintf(&data, "%i:%s", priority, devname) < 0)
                return log_oom_debug();

        if (readlink_malloc(filename, &buf) >= 0 && streq(buf, data))
                return 0;

        if (unlink(filename) < 0 && errno != ENOENT)
                log_device_debug_errno(dev, errno, "Failed to remove %s, ignoring: %m", filename);

        for (unsigned j = 0; j < CREATE_STACK_LINK_MAX_RETRIES; j++) {
                /* This may fail with -ENOENT when the parent directory is removed during
                 * creating the file by another udevd worker. */
                r = mkdir_p(dirname, 0755);
                if (r == -ENOENT)
                        continue;
                if (r < 0)
                        return log_device_debug_errno(dev, r, "Failed to create directory %s: %m", dirname);

                if (stat(dirname, &st) < 0) {
                        if (errno == ENOENT)
                                continue;
                        return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);
                }

                if (symlink(data, filename) < 0) {
                        if (errno == ENOENT)
                                continue;
                        return log_device_debug_errno(dev, errno, "Failed to create symbolic link %s: %m", filename);
                }

                /* The symlink was created. Check if the timestamp of directory is changed. */
                r = update_timestamp(dev, dirname, &st);
                if (r < 0)
                        return log_device_debug_errno(dev, r, "Failed to update timestamp of %s: %m", dirname);

                return 0;
        }

        return log_device_debug_errno(dev, SYNTHETIC_ERRNO(ELOOP), "Failed to create symbolic link %s: %m", filename);
}

/* manage "stack of names" with possibly specified device priorities */
static int link_update(sd_device *dev, const char *slink_in, bool add) {
        _cleanup_free_ char *slink = NULL, *dirname = NULL;
        const char *slink_name;
        char name_enc[NAME_MAX+1];
        int r;

        assert(dev);
        assert(slink_in);

        slink = strdup(slink_in);
        if (!slink)
                return log_oom_debug();

        path_simplify(slink);

        slink_name = path_startswith(slink, "/dev");
        if (!slink_name ||
            empty_or_root(slink_name) ||
            !path_is_normalized(slink_name))
                return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EINVAL),
                                              "Invalid symbolic link of device node: %s", slink);

        (void) udev_node_escape_path(slink_name, name_enc, sizeof(name_enc));
        dirname = path_join("/run/udev/links", name_enc);
        if (!dirname)
                return log_oom_debug();

        r = update_stack_directory(dev, dirname, add);
        if (r < 0)
                return r;

        for (unsigned i = 0; i < LINK_UPDATE_MAX_RETRIES; i++) {
                _cleanup_free_ char *target = NULL;
                struct stat st1 = {}, st2 = {};

                if (i > 0) {
                        char buf[FORMAT_TIMESPAN_MAX];
                        usec_t delay = MIN_RANDOM_DELAY + random_u64_range(MAX_RANDOM_DELAY - MIN_RANDOM_DELAY);

                        log_device_debug(dev, "Directory %s was updated, retrying to update devlink %s after %s.",
                                         dirname, slink, format_timespan(buf, sizeof(buf), delay, USEC_PER_MSEC));
                        (void) usleep(delay);
                }

                if (stat(dirname, &st1) < 0 && errno != ENOENT)
                        return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);

                r = link_find_prioritized(dev, add, dirname, &target);
                if (r < 0)
                        return log_device_debug_errno(dev, r, "Failed to determine device node with the highest priority for '%s': %m", slink);
                if (r == 0) {
                        log_device_debug(dev, "No reference left for '%s', removing", slink);

                        if (unlink(slink) < 0 && errno != ENOENT)
                                log_device_debug_errno(dev, errno, "Failed to remove '%s', ignoring: %m", slink);

                        (void) rmdir_parents(slink, "/dev");
                        return 0;
                }

                r = node_symlink(dev, target, slink);
                if (r < 0)
                        return r;

                if (stat(dirname, &st2) < 0 && errno != ENOENT)
                        return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);

                if (((st1.st_mode & S_IFMT) == 0 && (st2.st_mode & S_IFMT) == 0) ||
                    stat_inode_unmodified(&st1, &st2))
                        return 0;
        }

        return -ELOOP;
}

static int device_get_devpath_by_devnum(sd_device *dev, char **ret) {
        const char *subsystem;
        dev_t devnum;
        int r;

        assert(dev);
        assert(ret);

        r = sd_device_get_subsystem(dev, &subsystem);
        if (r < 0)
                return r;

        r = sd_device_get_devnum(dev, &devnum);
        if (r < 0)
                return r;

        return device_path_make_major_minor(streq(subsystem, "block") ? S_IFBLK : S_IFCHR, devnum, ret);
}

int udev_node_update(sd_device *dev, sd_device *dev_old) {
        _cleanup_free_ char *filename = NULL;
        const char *devnode, *devlink;
        int r;

        assert(dev);
        assert(dev_old);

        r = sd_device_get_devname(dev, &devnode);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get devnode: %m");

        if (DEBUG_LOGGING) {
                const char *id = NULL;

                (void) device_get_device_id(dev, &id);
                log_device_debug(dev, "Handling device node '%s', devnum=%s", devnode, strna(id));
        }

        /* update possible left-over symlinks */
        FOREACH_DEVICE_DEVLINK(dev_old, devlink) {
                /* check if old link name still belongs to this device */
                if (device_has_devlink(dev, devlink))
                        continue;

                log_device_debug(dev,
                                 "Removing/updating old device symlink '%s', which is no longer belonging to this device.",
                                 devlink);

                r = link_update(dev, devlink, /* add = */ false);
                if (r < 0)
                        log_device_warning_errno(dev, r,
                                                 "Failed to remove/update device symlink '%s', ignoring: %m",
                                                 devlink);
        }

        /* create/update symlinks, add symlinks to name index */
        FOREACH_DEVICE_DEVLINK(dev, devlink) {
                r = link_update(dev, devlink, /* add = */ true);
                if (r < 0)
                        log_device_warning_errno(dev, r,
                                                 "Failed to create/update device symlink '%s', ignoring: %m",
                                                 devlink);
        }

        r = device_get_devpath_by_devnum(dev, &filename);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get device path: %m");

        /* always add /dev/{block,char}/$major:$minor */
        r = node_symlink(dev, devnode, filename);
        if (r < 0)
                return log_device_warning_errno(dev, r, "Failed to create device symlink '%s': %m", filename);

        return 0;
}

int udev_node_remove(sd_device *dev) {
        _cleanup_free_ char *filename = NULL;
        const char *devlink;
        int r;

        assert(dev);

        /* remove/update symlinks, remove symlinks from name index */
        FOREACH_DEVICE_DEVLINK(dev, devlink) {
                r = link_update(dev, devlink, /* add = */ false);
                if (r < 0)
                        log_device_warning_errno(dev, r,
                                                 "Failed to remove/update device symlink '%s', ignoring: %m",
                                                 devlink);
        }

        r = device_get_devpath_by_devnum(dev, &filename);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get device path: %m");

        /* remove /dev/{block,char}/$major:$minor */
        if (unlink(filename) < 0 && errno != ENOENT)
                return log_device_debug_errno(dev, errno, "Failed to remove '%s': %m", filename);

        return 0;
}

int udev_node_apply_permissions(
                sd_device *dev,
                bool apply_mac,
                mode_t mode,
                uid_t uid,
                gid_t gid,
                OrderedHashmap *seclabel_list) {

        const char *devnode, *subsystem, *id = NULL;
        bool apply_mode, apply_uid, apply_gid;
        _cleanup_close_ int node_fd = -1;
        struct stat stats;
        dev_t devnum;
        int r;

        assert(dev);

        r = sd_device_get_devname(dev, &devnode);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get devname: %m");
        r = sd_device_get_subsystem(dev, &subsystem);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get subsystem: %m");
        r = sd_device_get_devnum(dev, &devnum);
        if (r < 0)
                return log_device_debug_errno(dev, r, "Failed to get devnum: %m");
        (void) device_get_device_id(dev, &id);

        if (streq(subsystem, "block"))
                mode |= S_IFBLK;
        else
                mode |= S_IFCHR;

        node_fd = open(devnode, O_PATH|O_NOFOLLOW|O_CLOEXEC);
        if (node_fd < 0) {
                if (errno == ENOENT) {
                        log_device_debug_errno(dev, errno, "Device node %s is missing, skipping handling.", devnode);
                        return 0; /* This is necessarily racey, so ignore missing the device */
                }

                return log_device_debug_errno(dev, errno, "Cannot open node %s: %m", devnode);
        }

        if (fstat(node_fd, &stats) < 0)
                return log_device_debug_errno(dev, errno, "cannot stat() node %s: %m", devnode);

        if ((mode != MODE_INVALID && (stats.st_mode & S_IFMT) != (mode & S_IFMT)) || stats.st_rdev != devnum) {
                log_device_debug(dev, "Found node '%s' with non-matching devnum %s, skipping handling.",
                                 devnode, strna(id));
                return 0; /* We might process a device that already got replaced by the time we have a look
                           * at it, handle this gracefully and step away. */
        }

        apply_mode = mode != MODE_INVALID && (stats.st_mode & 0777) != (mode & 0777);
        apply_uid = uid_is_valid(uid) && stats.st_uid != uid;
        apply_gid = gid_is_valid(gid) && stats.st_gid != gid;

        if (apply_mode || apply_uid || apply_gid || apply_mac) {
                bool selinux = false, smack = false;
                const char *name, *label;

                if (apply_mode || apply_uid || apply_gid) {
                        log_device_debug(dev, "Setting permissions %s, uid=" UID_FMT ", gid=" GID_FMT ", mode=%#o",
                                         devnode,
                                         uid_is_valid(uid) ? uid : stats.st_uid,
                                         gid_is_valid(gid) ? gid : stats.st_gid,
                                         mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);

                        r = fchmod_and_chown(node_fd, mode, uid, gid);
                        if (r < 0)
                                log_device_full_errno(dev, r == -ENOENT ? LOG_DEBUG : LOG_ERR, r,
                                                      "Failed to set owner/mode of %s to uid=" UID_FMT
                                                      ", gid=" GID_FMT ", mode=%#o: %m",
                                                      devnode,
                                                      uid_is_valid(uid) ? uid : stats.st_uid,
                                                      gid_is_valid(gid) ? gid : stats.st_gid,
                                                      mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
                } else
                        log_device_debug(dev, "Preserve permissions of %s, uid=" UID_FMT ", gid=" GID_FMT ", mode=%#o",
                                         devnode,
                                         uid_is_valid(uid) ? uid : stats.st_uid,
                                         gid_is_valid(gid) ? gid : stats.st_gid,
                                         mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);

                /* apply SECLABEL{$module}=$label */
                ORDERED_HASHMAP_FOREACH_KEY(label, name, seclabel_list) {
                        int q;

                        if (streq(name, "selinux")) {
                                selinux = true;

                                q = mac_selinux_apply_fd(node_fd, devnode, label);
                                if (q < 0)
                                        log_device_full_errno(dev, q == -ENOENT ? LOG_DEBUG : LOG_ERR, q,
                                                              "SECLABEL: failed to set SELinux label '%s': %m", label);
                                else
                                        log_device_debug(dev, "SECLABEL: set SELinux label '%s'", label);

                        } else if (streq(name, "smack")) {
                                smack = true;

                                q = mac_smack_apply_fd(node_fd, SMACK_ATTR_ACCESS, label);
                                if (q < 0)
                                        log_device_full_errno(dev, q == -ENOENT ? LOG_DEBUG : LOG_ERR, q,
                                                              "SECLABEL: failed to set SMACK label '%s': %m", label);
                                else
                                        log_device_debug(dev, "SECLABEL: set SMACK label '%s'", label);

                        } else
                                log_device_error(dev, "SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label);
                }

                /* set the defaults */
                if (!selinux)
                        (void) mac_selinux_fix_fd(node_fd, devnode, LABEL_IGNORE_ENOENT);
                if (!smack)
                        (void) mac_smack_apply_fd(node_fd, SMACK_ATTR_ACCESS, NULL);
        }

        /* always update timestamp when we re-use the node, like on media change events */
        r = futimens_opath(node_fd, NULL);
        if (r < 0)
                log_device_debug_errno(dev, r, "Failed to adjust timestamp of node %s: %m", devnode);

        return 0;
}