// SPDX-License-Identifier: GPL-2.0-or-later

#include <errno.h>
#include <stddef.h>
#include <stdint.h>

#include <netinet/ip.h>

#include <sys/socket.h>

#include <linux/tcp.h>
#include <linux/virtio_net.h>

#include "util.h"
#include "ip.h"
#include "passt.h"
#include "siphash.h"
#include "inany.h"
#include "vhost_user.h"
#include "tcp.h"
#include "pcap.h"
#include "flow.h"
#include "tcp_conn.h"
#include "flow_table.h"
#include "tcp_vu.h"
#include "tcp_internal.h"
#include "checksum.h"

#define CONN_V4(conn)		(!!inany_v4(&(conn)->faddr))
#define CONN_V6(conn)		(!CONN_V4(conn))

/**
 * struct tcp_payload_t - TCP header and data to send segments with payload
 * @th:		TCP header
 * @data:	TCP data
 */
struct tcp_payload_t {
	struct tcphdr th;
	uint8_t data[IP_MAX_MTU - sizeof(struct tcphdr)];
};

/**
 * struct tcp_flags_t - TCP header and data to send zero-length
 *                      segments (flags)
 * @th:		TCP header
 * @opts	TCP options
 */
struct tcp_flags_t {
	struct tcphdr th;
	char opts[OPT_MSS_LEN + OPT_WS_LEN + 1];
};

/* vhost-user */
static const struct virtio_net_hdr vu_header = {
	.flags = VIRTIO_NET_HDR_F_DATA_VALID,
	.gso_type = VIRTIO_NET_HDR_GSO_NONE,
};

int tcp_vu_send_flag(struct ctx *c, struct tcp_tap_conn *conn, int flags)
{
	VuDev *vdev = (VuDev *)&c->vdev;
	VuVirtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE];
	size_t tlen, vnet_hdrlen, l4len, optlen;
	struct virtio_net_hdr_mrg_rxbuf *vh;
	struct iovec l2_iov[TCP_NUM_IOVS];
	VuVirtqElement elem;
	struct iovec in_sg;
	struct ethhdr *eh;
	int nb_ack;
	int ret;

	elem.out_num = 0;
	elem.out_sg = NULL;
	elem.in_num = 1;
	elem.in_sg = &in_sg;
	ret = vu_queue_pop(vdev, vq, &elem);
	if (ret < 0)
		return 0;

	if (elem.in_num < 1) {
		err("virtio-net receive queue contains no in buffers");
		vu_queue_rewind(vdev, vq, 1);
		return 0;
	}

	vh = elem.in_sg[0].iov_base;

	vh->hdr = vu_header;
	if (vu_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) {
		vnet_hdrlen = sizeof(struct virtio_net_hdr_mrg_rxbuf);
		vh->num_buffers = htole16(1);
	} else {
		vnet_hdrlen = sizeof(struct virtio_net_hdr);
	}

	l2_iov[TCP_IOV_TAP].iov_base = NULL;
	l2_iov[TCP_IOV_TAP].iov_len = 0;
	l2_iov[TCP_IOV_ETH].iov_base = (char *)elem.in_sg[0].iov_base + vnet_hdrlen;
	l2_iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr);

	eh = l2_iov[TCP_IOV_ETH].iov_base;

	memcpy(eh->h_dest, c->mac_guest, sizeof(eh->h_dest));
	memcpy(eh->h_source, c->mac, sizeof(eh->h_source));

	if (CONN_V4(conn)) {
		struct tcp_flags_t *payload;
		struct iphdr *iph;
		uint32_t seq;

		l2_iov[TCP_IOV_IP].iov_base = (char *)l2_iov[TCP_IOV_ETH].iov_base +
						      l2_iov[TCP_IOV_ETH].iov_len;
		l2_iov[TCP_IOV_IP].iov_len = sizeof(struct iphdr);
		l2_iov[TCP_IOV_PAYLOAD].iov_base = (char *)l2_iov[TCP_IOV_IP].iov_base +
							   l2_iov[TCP_IOV_IP].iov_len;

		eh->h_proto = htons(ETH_P_IP);

		iph = l2_iov[TCP_IOV_IP].iov_base;
		*iph = (struct iphdr)L2_BUF_IP4_INIT(IPPROTO_TCP);

		payload = l2_iov[TCP_IOV_PAYLOAD].iov_base;
		payload->th = (struct tcphdr){
			.doff = offsetof(struct tcp_flags_t, opts) / 4,
			.ack = 1
		};

		seq = conn->seq_to_tap;
		ret = tcp_prepare_flags(c, conn, flags, &payload->th, payload->opts, &optlen);
		if (ret <= 0) {
			vu_queue_rewind(vdev, vq, 1);
			return ret;
		}

		l4len = tcp_l2_buf_fill_headers(c, conn, l2_iov, optlen, NULL,
						seq);
		/* cppcheck-suppress unreadVariable */
		l2_iov[TCP_IOV_PAYLOAD].iov_len = l4len;

		tlen =  l4len + sizeof(*iph) + sizeof(struct ethhdr);

		if (*c->pcap) {
			uint32_t sum = proto_ipv4_header_psum(l4len,
							      IPPROTO_TCP,
				/* cppcheck-suppress unknownEvaluationOrder */
				(struct in_addr){ .s_addr = iph->saddr },
				(struct in_addr){ .s_addr = iph->daddr });

			payload->th.check = 0;
			payload->th.check = csum(&payload->th, optlen + sizeof(struct tcphdr), sum);
		}
	} else {
		struct tcp_flags_t *payload;
		struct ipv6hdr *ip6h;
		uint32_t seq;

		l2_iov[TCP_IOV_IP].iov_base = (char *)l2_iov[TCP_IOV_ETH].iov_base +
						      l2_iov[TCP_IOV_ETH].iov_len;
		l2_iov[TCP_IOV_IP].iov_len = sizeof(struct ipv6hdr);
		l2_iov[TCP_IOV_PAYLOAD].iov_base = (char *)l2_iov[TCP_IOV_IP].iov_base +
							   l2_iov[TCP_IOV_IP].iov_len;

		eh->h_proto = htons(ETH_P_IPV6);

		ip6h = l2_iov[TCP_IOV_IP].iov_base;
		*ip6h = (struct ipv6hdr)L2_BUF_IP6_INIT(IPPROTO_TCP);

		payload = l2_iov[TCP_IOV_PAYLOAD].iov_base;
		payload->th = (struct tcphdr){
			.doff = offsetof(struct tcp_flags_t, opts) / 4,
			.ack = 1
		};

		seq = conn->seq_to_tap;
		ret = tcp_prepare_flags(c, conn, flags, &payload->th, payload->opts, &optlen);
		if (ret <= 0) {
			vu_queue_rewind(vdev, vq, 1);
			return ret;
		}

		l4len = tcp_l2_buf_fill_headers(c, conn, l2_iov, optlen, NULL,
						seq);
		/* cppcheck-suppress unreadVariable */
		l2_iov[TCP_IOV_PAYLOAD].iov_len = l4len;

		tlen =  l4len + sizeof(*ip6h) + sizeof(struct ethhdr);

		if (*c->pcap) {
			uint32_t sum = proto_ipv6_header_psum(l4len,
							      IPPROTO_TCP,
							      &ip6h->saddr,
							      &ip6h->daddr);

			payload->th.check = 0;
			payload->th.check = csum(&payload->th, optlen + sizeof(struct tcphdr), sum);
		}
	}

	pcap((void *)eh, tlen);

	tlen += vnet_hdrlen;
	vu_queue_fill(vdev, vq, &elem, tlen, 0);
	nb_ack = 1;

	if (flags & DUP_ACK) {
		VuVirtqElement elem_dup;
		struct iovec in_sg_dup;

		elem_dup.out_num = 0;
		elem_dup.out_sg = NULL;
		elem_dup.in_num = 1;
		elem_dup.in_sg = &in_sg_dup;
		ret = vu_queue_pop(vdev, vq, &elem_dup);
		if (ret == 0) {
			if (elem_dup.in_num < 1 || elem_dup.in_sg[0].iov_len < tlen) {
				vu_queue_rewind(vdev, vq, 1);
			} else {
				memcpy(elem_dup.in_sg[0].iov_base, vh, tlen);
				nb_ack++;
			}
		}
	}

	vu_queue_flush(vdev, vq, nb_ack);
	vu_queue_notify(vdev, vq);

	return 0;
}

int tcp_vu_data_from_sock(struct ctx *c, struct tcp_tap_conn *conn)
{
	uint32_t wnd_scaled = conn->wnd_from_tap << conn->ws_from_tap;
	static struct iovec iov_vu[VIRTQUEUE_MAX_SIZE];
	static VuVirtqElement elem[VIRTQUEUE_MAX_SIZE];
	static struct iovec in_sg[VIRTQUEUE_MAX_SIZE];
	VuDev *vdev = (VuDev *)&c->vdev;
	VuVirtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE];
	size_t l2_hdrlen, vnet_hdrlen, fillsize;
	int s = conn->sock, v4 = CONN_V4(conn);
	struct iovec l2_iov[TCP_NUM_IOVS];
	int i, ret, iov_cnt, iov_used;
	struct msghdr mh_sock = { 0 };
	uint16_t mss = MSS_GET(conn);
	static int in_sg_count;
	uint32_t already_sent;
	const uint16_t *check;
	struct iovec *first;
	bool has_mrg_rxbuf;
	int segment_size;
	int num_buffers;
	ssize_t len;

	if (!vu_queue_enabled(vq) || !vu_queue_started(vq)) {
		err("Got packet, but no available descriptors on RX virtq.");
		return 0;
	}

	already_sent = conn->seq_to_tap - conn->seq_ack_from_tap;

	if (SEQ_LT(already_sent, 0)) {
		/* RFC 761, section 2.1. */
		flow_trace(conn, "ACK sequence gap: ACK for %u, sent: %u",
			   conn->seq_ack_from_tap, conn->seq_to_tap);
		conn->seq_to_tap = conn->seq_ack_from_tap;
		already_sent = 0;
	}

	if (!wnd_scaled || already_sent >= wnd_scaled) {
		conn_flag(c, conn, STALLED);
		conn_flag(c, conn, ACK_FROM_TAP_DUE);
		return 0;
	}

	/* Set up buffer descriptors we'll fill completely and partially. */

	fillsize = wnd_scaled;

	iov_vu[0].iov_base = tcp_buf_discard;
	iov_vu[0].iov_len = already_sent;
	fillsize -= already_sent;

	has_mrg_rxbuf = vu_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF);
	if (has_mrg_rxbuf)
		vnet_hdrlen = sizeof(struct virtio_net_hdr_mrg_rxbuf);
	else
		vnet_hdrlen = sizeof(struct virtio_net_hdr);
	l2_hdrlen = vnet_hdrlen + sizeof(struct ethhdr) + sizeof(struct tcphdr);
	if (v4)
		l2_hdrlen += sizeof(struct iphdr);
	else
		l2_hdrlen += sizeof(struct ipv6hdr);

	iov_cnt = 0;
	in_sg_count = 0;
	segment_size = 0;
	while (fillsize > 0 && iov_cnt < VIRTQUEUE_MAX_SIZE - 1 &&
			       in_sg_count < ARRAY_SIZE(in_sg)) {

		elem[iov_cnt].out_num = 0;
		elem[iov_cnt].out_sg = NULL;
		elem[iov_cnt].in_num = ARRAY_SIZE(in_sg) - in_sg_count;
		elem[iov_cnt].in_sg = &in_sg[in_sg_count];
		ret = vu_queue_pop(vdev, vq, &elem[iov_cnt]);
		if (ret < 0)
			break;

		if (elem[iov_cnt].in_num < 1) {
			err("virtio-net receive queue contains no in buffers");
			goto err;
		}
		in_sg_count += elem[iov_cnt].in_num;

		ASSERT(elem[iov_cnt].in_num == 1);
		ASSERT(elem[iov_cnt].in_sg[0].iov_len >= l2_hdrlen);

		if (segment_size == 0) {
			iov_vu[iov_cnt + 1].iov_base =
					(char *)elem[iov_cnt].in_sg[0].iov_base + l2_hdrlen;
			iov_vu[iov_cnt + 1].iov_len =
					elem[iov_cnt].in_sg[0].iov_len - l2_hdrlen;
		} else {
			iov_vu[iov_cnt + 1].iov_base = elem[iov_cnt].in_sg[0].iov_base;
			iov_vu[iov_cnt + 1].iov_len = elem[iov_cnt].in_sg[0].iov_len;
		}

		if (iov_vu[iov_cnt + 1].iov_len > fillsize)
			iov_vu[iov_cnt + 1].iov_len = fillsize;

		segment_size += iov_vu[iov_cnt + 1].iov_len;
		if (!has_mrg_rxbuf) {
			segment_size = 0;
		} else if (segment_size >= mss) {
			iov_vu[iov_cnt + 1].iov_len -= segment_size - mss;
			segment_size = 0;
		}
		fillsize -= iov_vu[iov_cnt + 1].iov_len;

		iov_cnt++;
	}
	if (iov_cnt == 0)
		return 0;

	ret = 0;
	mh_sock.msg_iov = iov_vu;
	mh_sock.msg_iovlen = iov_cnt + 1;

	do
		len = recvmsg(s, &mh_sock, MSG_PEEK);
	while (len < 0 && errno == EINTR);

	if (len < 0)
		goto err;

	if (!len) {
		vu_queue_rewind(vdev, vq, iov_cnt);
		if ((conn->events & (SOCK_FIN_RCVD | TAP_FIN_SENT)) == SOCK_FIN_RCVD) {
			ret = tcp_vu_send_flag(c, conn, FIN | ACK);
			if (ret) {
				tcp_rst(c, conn);
				return ret;
			}

			conn_event(c, conn, TAP_FIN_SENT);
		}

		return 0;
	}

	len -= already_sent;
	if (len <= 0) {
		conn_flag(c, conn, STALLED);
		vu_queue_rewind(vdev, vq, iov_cnt);
		return 0;
	}

	conn_flag(c, conn, ~STALLED);

	/* Likely, some new data was acked too. */
	tcp_update_seqack_wnd(c, conn, 0, NULL);

	/* initialize headers */
	iov_used = 0;
	num_buffers = 0;
	check = NULL;
	segment_size = 0;
	for (i = 0; i < iov_cnt && len; i++) {

		if (segment_size == 0)
			first = &iov_vu[i + 1];

		if (iov_vu[i + 1].iov_len > (size_t)len)
			iov_vu[i + 1].iov_len = len;

		len -= iov_vu[i + 1].iov_len;
		iov_used++;

		segment_size += iov_vu[i + 1].iov_len;
		num_buffers++;

		if (segment_size >= mss || len == 0 ||
		    i + 1 == iov_cnt || !has_mrg_rxbuf) {
			char *base = (char *)first->iov_base - l2_hdrlen;
			size_t size = first->iov_len + l2_hdrlen;
			struct virtio_net_hdr_mrg_rxbuf *vh;
			struct ethhdr *eh;
			size_t l4len;

			vh = (struct virtio_net_hdr_mrg_rxbuf *)base;

			vh->hdr = vu_header;
			if (has_mrg_rxbuf)
				vh->num_buffers = htole16(num_buffers);

			l2_iov[TCP_IOV_TAP].iov_base = NULL;
			l2_iov[TCP_IOV_TAP].iov_len = 0;
			l2_iov[TCP_IOV_ETH].iov_base = base + vnet_hdrlen;
			l2_iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr);

			eh = l2_iov[TCP_IOV_ETH].iov_base;

			memcpy(eh->h_dest, c->mac_guest, sizeof(eh->h_dest));
			memcpy(eh->h_source, c->mac, sizeof(eh->h_source));

			/* initialize header */
			if (v4) {
				struct tcp_payload_t *payload;
				struct iphdr *iph;

				l2_iov[TCP_IOV_IP].iov_base = (char *)l2_iov[TCP_IOV_ETH].iov_base +
								      l2_iov[TCP_IOV_ETH].iov_len;
				l2_iov[TCP_IOV_IP].iov_len = sizeof(struct iphdr);
				l2_iov[TCP_IOV_PAYLOAD].iov_base = (char *)l2_iov[TCP_IOV_IP].iov_base +
									   l2_iov[TCP_IOV_IP].iov_len;


				eh->h_proto = htons(ETH_P_IP);

				iph = l2_iov[TCP_IOV_IP].iov_base;
				*iph = (struct iphdr)L2_BUF_IP4_INIT(IPPROTO_TCP);
				payload = l2_iov[TCP_IOV_PAYLOAD].iov_base;
				payload->th = (struct tcphdr){
					.doff = offsetof(struct tcp_payload_t, data) / 4,
					.ack = 1
				};

				l4len = tcp_l2_buf_fill_headers(c, conn, l2_iov,
								segment_size,
								len ? check : NULL,
								conn->seq_to_tap);
				l2_iov[TCP_IOV_PAYLOAD].iov_len = l4len;

				if (*c->pcap) {
					uint32_t sum = proto_ipv4_header_psum(l4len,
									      IPPROTO_TCP,
				/* cppcheck-suppress unknownEvaluationOrder */
				(struct in_addr){ .s_addr = iph->saddr },
				(struct in_addr){ .s_addr = iph->daddr });

					first->iov_base = &payload->th;
					first->iov_len = size - l2_hdrlen + sizeof(struct tcphdr);
					payload->th.check = 0;
					payload->th.check = csum_iov(first, num_buffers, sum);
				}

				check = &iph->check;
			} else {
				struct tcp_payload_t *payload;
				struct ipv6hdr *ip6h;

				l2_iov[TCP_IOV_IP].iov_base = (char *)l2_iov[TCP_IOV_ETH].iov_base +
								      l2_iov[TCP_IOV_ETH].iov_len;
				l2_iov[TCP_IOV_IP].iov_len = sizeof(struct ipv6hdr);
				l2_iov[TCP_IOV_PAYLOAD].iov_base = (char *)l2_iov[TCP_IOV_IP].iov_base +
									   l2_iov[TCP_IOV_IP].iov_len;


				eh->h_proto = htons(ETH_P_IPV6);

				ip6h = l2_iov[TCP_IOV_IP].iov_base;
				*ip6h = (struct ipv6hdr)L2_BUF_IP6_INIT(IPPROTO_TCP);

				payload = l2_iov[TCP_IOV_PAYLOAD].iov_base;
				payload->th = (struct tcphdr){
					.doff = offsetof(struct tcp_payload_t, data) / 4,
					.ack = 1
				};
;
				l4len = tcp_l2_buf_fill_headers(c, conn, l2_iov,
								segment_size,
								NULL, conn->seq_to_tap);
				l2_iov[TCP_IOV_PAYLOAD].iov_len = l4len;

				if (*c->pcap) {
					uint32_t sum = proto_ipv6_header_psum(l4len,
									      IPPROTO_TCP,
									      &ip6h->saddr,
									      &ip6h->daddr);

					first->iov_base = &payload->th;
					first->iov_len = size - l2_hdrlen + sizeof(struct tcphdr);

					payload->th.check = 0;
					payload->th.check = csum_iov(first, num_buffers, sum);
				}
			}

			/* set iov for pcap logging */
			first->iov_base = eh;
			first->iov_len = size - vnet_hdrlen;

			pcap_iov(first, num_buffers);

			/* set iov_len for vu_queue_fill_by_index(); */

			first->iov_base = base;
			first->iov_len = size;

			conn->seq_to_tap += segment_size;

			segment_size = 0;
			num_buffers = 0;
		}
	}

	/* release unused buffers */
	vu_queue_rewind(vdev, vq, iov_cnt - iov_used);

	/* send packets */
	for (i = 0; i < iov_used; i++)
		vu_queue_fill(vdev, vq, &elem[i], iov_vu[i + 1].iov_len, i);

	vu_queue_flush(vdev, vq, iov_used);
	vu_queue_notify(vdev, vq);

	conn_flag(c, conn, ACK_FROM_TAP_DUE);

	return 0;
err:
	vu_queue_rewind(vdev, vq, iov_cnt);

	if (errno != EAGAIN && errno != EWOULDBLOCK) {
		ret = -errno;
		tcp_rst(c, conn);
	}

	return ret;
}