#include <sys/types.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <time.h>
#include <errno.h>
#include <linux/netfilter.h>

#include <dotconf.h>
#include <libpool.h>
#include <libconfig.h>

#ifdef USE_SOCKSTAT
#include <sys/socket.h>
#include <sys/un.h>
#include <pthread.h>
#endif

	char *string;
	struct config_entry *next;
	struct packet_info ip;
	struct cidr	cidr;

};

struct config_entry *blacklistbl = NULL;
struct config_entry *whitelistbl = NULL;
struct config_entry *blacklist = NULL;
struct config_entry *whitelist = NULL;

struct bl_context {

	int	permissions;
	const char *current_end_token;

	pool_t *pool;
};

enum permissions {
	O_ROOT = 1,
	O_HOSTSECTION = 2,
	O_LAST = 4
};

static DOTCONF_CB(host_section_open);
static DOTCONF_CB(common_section_close);
static DOTCONF_CB(common_option);
static DOTCONF_CB(toggle_option);
static DOTCONF_CB(facility_option);

static const char *end_host = "</host>";
char msgbuf[BUFFERSIZE];

struct config {
	int	allow_non25;
	int	allow_nonsyn;
	int	default_accept;
	int	dryrun;
	int 	log_facility;
	int	queueno;
	int	quiet;
	int	debug;
	struct config_entry *blacklistbl;
	struct config_entry *whitelistbl;
	struct config_entry *blacklist;
	struct config_entry *whitelist;
};

static struct config conf = { 0, 0, 1, 0, LOG_DAEMON, 0 };
static struct config conf = { 0, 0, 1, 0, LOG_DAEMON, 0, 0, 0, NULL, NULL, NULL, NULL };

struct pbl_stat_info {
	uint32_t	cacheaccept;
	uint32_t	cachereject;
	uint32_t	whitelistblhits;
	uint32_t	blacklistblhits;
	uint32_t	whitelisthits;

static void get_ip_string(const struct packet_info *ip);
static void pbl_set_verdict(struct PBL_HANDLE *h, PBL_ID_T id,
        unsigned int verdict);

static int pbl_callback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
	struct nfq_data *nfa, void *data);
	
static const configoption_t options[] = {
	{"<host>", ARG_NONE, host_section_open, NULL, O_ROOT},
	{"</host>", ARG_NONE, common_section_close, NULL, O_ROOT},
	{"blacklistbl", ARG_STR, common_option, NULL, O_HOSTSECTION},
	{"whitelistbl", ARG_STR, common_option, NULL, O_HOSTSECTION},
	{"whitelist", ARG_STR, common_option, NULL, O_HOSTSECTION},
	{"blacklist", ARG_STR, common_option, NULL, O_HOSTSECTION},
	{"fallthroughaccept", ARG_TOGGLE, toggle_option, NULL, O_ROOT},
	{"allownonport25", ARG_TOGGLE, toggle_option, NULL, O_ROOT},
	{"allownonsyn", ARG_TOGGLE, toggle_option, NULL, O_ROOT},
	{"dryrun", ARG_TOGGLE, toggle_option, NULL, O_ROOT},
	{"quiet", ARG_TOGGLE, toggle_option, NULL, O_ROOT},
#ifdef USE_CACHE
	{"cachettl", ARG_INT, toggle_option, NULL, O_ROOT},
	{"cachesize", ARG_INT, toggle_option, NULL, O_ROOT},
#endif
	{"logfacility", ARG_STR, facility_option, NULL, O_ROOT},
#ifdef HAVE_NFQUEUE
	{"queueno", ARG_INT, common_option, NULL, O_ROOT},
typedef struct facility {
	char *string;
	int num;
} facility;

static struct facility facenum[] = {
	{"auth", LOG_AUTH},
	{"authpriv", LOG_AUTHPRIV},
	{"cron", LOG_CRON},
	{"daemon", LOG_DAEMON},
	{"kern", LOG_KERN},
	{"lpr", LOG_LPR},
	{"mail", LOG_MAIL},
	{"news", LOG_NEWS},
	{"syslog", LOG_SYSLOG},
	{"user", LOG_USER},
	{"uucp", LOG_UUCP},
	{"local0", LOG_LOCAL0},
	{"local1", LOG_LOCAL1},
#endif
	LAST_OPTION
};

FUNC_ERRORHANDLER(error_handler) {

	{"local2", LOG_LOCAL2},
	{"local3", LOG_LOCAL3},
	{"local4", LOG_LOCAL4},
	{"local5", LOG_LOCAL5},
	{"local6", LOG_LOCAL6},
	{"local7", LOG_LOCAL7},
	fprintf(stderr, "[error] %s\n", msg);
	return 1;

}
	NULL
};

/*
 * SYNOPSIS:
 *   void daemonize(void);
 *
 * NOTES:
 *   This function accomplishes everything needed to become a daemon.
 *   Including closing standard in/out/err and forking.

	}
#endif

	/* the get_ip_string is set AFTER the check_packet_*
	 * calls because of the possibility they could screw with
	 * msgbuf.  They shouldn't, really, but better safe than
	 * sorry, at least for now. */
	if (check_packet_list(&ip, whitelist) == 1) {
	if (check_packet_list(&ip, conf.whitelist) == 1) {
		get_ip_string(&ip);
		if (!conf.quiet) {
			if (conf.debug == 0) {
				syslog(LOG_INFO,
					"[accept whitelist] [%s]",
						msgbuf);
			} else {
				fprintf(stderr,
					"[accept whitelist] [%s]",
						msgbuf);
			}
		}
		statistics.whitelisthits++;
		retval=NF_ACCEPT;
	} else
	if (check_packet_list(&ip, blacklist) == 1) {
	if (check_packet_list(&ip, conf.blacklist) == 1) {
		get_ip_string(&ip);
		if (!conf.quiet) {
			if (conf.debug == 0) {
				syslog(LOG_INFO,
					"[reject blacklist] [%s]",
						msgbuf);
			} else {
				fprintf(stderr,
					"[reject blacklist] [%s]",
						msgbuf);
			}
				
		}
		statistics.blacklisthits++;
		retval=NF_DROP;
	} else
	if (check_packet_dnsbl(&ip, whitelistbl) == 1) {
	if (check_packet_dnsbl(&ip, conf.whitelistbl) == 1) {
		get_ip_string(&ip);
		if (!conf.quiet) {
			if (conf.debug == 0) {
				syslog(LOG_INFO,
					"[accept dnsbl] [%s]",
						msgbuf);
			} else {
				fprintf(stderr,
					"[accept dnsbl] [%s]",
						msgbuf);
			}
		}
		statistics.whitelistblhits++;
		retval=NF_ACCEPT;
	} else
	if (check_packet_dnsbl(&ip, blacklistbl) == 1) {
	if (check_packet_dnsbl(&ip, conf.blacklistbl) == 1) {
		get_ip_string(&ip);
		if (!conf.quiet) {
			if (conf.debug == 0) {
				syslog(LOG_INFO,
					"[reject dnsbl] [%s]",
						msgbuf);
			} else {

 *   global variables.  It may cause the program to abort with a failure
 *   if the configuration is unreadable or unparsable.  Due to this fact,
 *   it should only be called during start-up and not from the main loop.
 *
 */
void parse_config(void) {

	configfile_t *configfile;
	struct bl_context context;

	context.pool = pool_new(NULL);
	configfile = dotconf_create(CONFIGFILE, options, (void *)&context,
	config_t *config = NULL;
	config_setting_t *config_setting = NULL;
	struct ce *config_entry = NULL;
	int result = 0;
	int i = 0;
	const char *facstr = NULL;
	
	config_init(config);
	result = config_read_file(config, "test.config");
	if (result == CONFIG_FALSE) {
		CASE_INSENSITIVE);
	if (!configfile) {
		fprintf(stderr, "Error opening config file\n");
		if (config_error_type(config) == CONFIG_ERR_PARSE) {
			fprintf (stderr, "Error parsing config file %s, line %d: %s\n",
		exit(EXIT_FAILURE);
	}
	if (dotconf_command_loop(configfile) == 0) {
		fprintf(stderr, "Error reading configuration file\n");
				config_error_file(config),
				config_error_line(config),
				config_error_text(config));
		}
		if (config_error_type(config) == CONFIG_ERR_FILE_IO) {
			fprintf (stderr, "Error reading config file: %s\n",
				config_error_text(config));
		}
		exit(EXIT_FAILURE);
	}

	/* there are default, so I'm not checking return values.  If it fails,
	 * then we'll just stay with the default, whatever that might be. */
	config_lookup_bool(config, "options.fallthroughaccept", &conf.default_accept);
	config_lookup_bool(config, "options.allownonport25", &conf.allow_non25);
	config_lookup_bool(config, "options.dryrun", &conf.dryrun);
	config_lookup_bool(config, "options.allownonsyn", &conf.allow_nonsyn);
	config_lookup_bool(config, "options.quiet", &conf.quiet);
	dotconf_cleanup(configfile);
	pool_free(context.pool);

	return;
}

#ifdef USE_CACHE
	config_lookup_int(config, "cache.ttl", &packet_cache_ttl);

	if (packet_cache_ttl < 0) {
		packet_cache_ttl = USE_CACHE_DEF_TTL;
		fprintf(stderr, "config cache TTL negative - using default");
	}

	config_lookup_int(config, "cache.len", &packet_cache_len);

	if (packet_cache_len < 0) {
		packet_cache_len = USE_CACHE_DEF_LEN;
		fprintf(stderr, "config size TTL negative - using default");
	}
#endif

	config_lookup_string(config, "log.facility", &facstr);
	i = 0;
	while (&facenum[i] != NULL) {
		if (strcasecmp(facenum[i].string, facstr) == 0) {
			conf.log_facility = facenum[i].num;
			break;
		} else {
			i++;
		}
	}
	
	config_lookup_int(config, "config.queueno", &conf.queueno);
	
	if (conf.queueno < 0) {
		conf.queueno = 1;
		fprintf(stderr, "queueno negative - using default");
	}

	config_setting = config_lookup(config, "blacklistbl");
	parse_config_bl_list(config_setting, 1);
	config_setting = config_lookup(config, "whitelistbl");
	parse_config_bl_list(config_setting, 2);
	config_setting = config_lookup(config, "blacklist");
	parse_config_bl_list(config_setting, 3);
	config_setting = config_lookup(config, "whitelist");
	parse_config_bl_list(config_setting, 4);
	
}

parse_config_bl_list(config_setting_t *c, int type) {

	struct config_entry *ce, *tmp;
	int i = 0, len = 0;
	char *setting;
#ifdef HAVE_FIREDNS
	size_t blacklistlen = 0;
#endif

	len = config_setting_length(c);
	while (i++ < len) {
		setting = config_setting_get_string_elem(c, i);
		ce = malloc(sizeof(struct config_entry));
		if (ce == NULL) {
			/* shouldn't happen... */
			fprintf(stderr, "Failed to allocate memory for ce struct\n");
			exit(EXIT_FAILURE);
		}

		ce->string = (char *)strdup(setting);
		ce->next = NULL;
#ifdef HAVE_FIREDNS
		blacklistlen = strlen(ce->string);
		if (ce->string[blacklistlen - 1] == '.') {
			ce->string[blacklistlen - 1] = '\0';
		}
#endif

		switch (type) {
			case 1:
				if (conf.blacklistbl == NULL) {
					conf.blacklistbl = ce;
					continue;
				} else {
					tmp = conf.blacklistbl;
				}
				break;
			case 2:
				if (conf.whitelistbl == NULL) {
					conf.whitelistbl = ce;
					continue;
				} else {
					tmp = conf.whitelistbl;
				}
			case 3:
				if (parse_cidr(ce) == -1) {
					fprintf(stderr, "Error parsing CIDR in %s, ignoring\n", ce->string);
					free(ce->string);
					free(ce);
					continue;
				}
				if (conf.blacklist == NULL) {
					conf.blacklist = ce;
					continue;
				} else {
					tmp = conf.blacklist;
				}
				break;
			case 4:
				if (parse_cidr(ce) == -1) {
					fprintf(stderr, "Error parsing CIDR in %s, ignoring\n", ce->string);
					free(ce->string);
					free(ce);
					continue;
				}
				if (conf.whitelist == NULL) {
					conf.whitelist = ce;
					continue;
				} else {
					tmp = conf.whitelist;
				}
				break;
		}	

		while (tmp->next != NULL) {
			tmp = tmp->next;
		}

		tmp->next = ce;

	}
}
	
/*
 * SYNOPSIS:
 *   void parse_arguments(
 *                        int argc,
 *                        char **argv
 *                       );
 *

			default:
				exit(EXIT_FAILURE);
				break;
		}
	}

	return;
}

DOTCONF_CB(common_section_close) {

	struct bl_context *context = (struct bl_context *)ctx;

	return context->current_end_token;
}

DOTCONF_CB(toggle_option) {

	if (strcasecmp(cmd->name, "fallthroughaccept") == 0) {
		conf.default_accept = cmd->data.value;
		return NULL;
	}
	if (strcasecmp(cmd->name, "allownonport25") == 0) {
		conf.allow_non25 = cmd->data.value;
		return NULL;
	}
	if (strcasecmp(cmd->name, "dryrun") == 0) {
		conf.dryrun = cmd->data.value;
		return NULL;
	}
	if (strcasecmp(cmd->name, "allownonsyn") == 0) {
		conf.allow_nonsyn = cmd->data.value;
		return NULL;
	}
	if (strcasecmp(cmd->name, "quiet") == 0) {
		conf.quiet = cmd->data.value;
		return NULL;
	}
#ifdef USE_CACHE
	if (strcasecmp(cmd->name, "cachettl") == 0) {
		if (cmd->data.value < 0) {
			fprintf(stderr, "Error parsing config: cachettl cannot be a negative value\n");
			exit(EXIT_FAILURE);
		}
		packet_cache_ttl = cmd->data.value;
		return NULL;
	}
	if (strcasecmp(cmd->name, "cachesize") == 0) {
		if (cmd->data.value < 0) {
			fprintf(stderr, "Error parsing config: cachelen cannot be a negative value\n");
			exit(EXIT_FAILURE);
		}
		packet_cache_len = cmd->data.value;
		return NULL;
	}
#endif

	return NULL;
}

DOTCONF_CB(facility_option) {

	if (strcasecmp(cmd->data.str, "auth") == 0) {
		conf.log_facility = LOG_AUTH;
	} else if (strcasecmp(cmd->data.str, "authpriv") == 0) {
		conf.log_facility = LOG_AUTHPRIV;
	} else if (strcasecmp(cmd->data.str, "cron") == 0) {
		conf.log_facility = LOG_CRON;
	} else if (strcasecmp(cmd->data.str, "daemon") == 0) {
		conf.log_facility = LOG_DAEMON;
	} else if (strcasecmp(cmd->data.str, "kern") == 0) {
		conf.log_facility = LOG_KERN;
	} else if (strcasecmp(cmd->data.str, "lpr") == 0) {
		conf.log_facility = LOG_LPR;
	} else if (strcasecmp(cmd->data.str, "mail") == 0) {
		conf.log_facility = LOG_MAIL;
	} else if (strcasecmp(cmd->data.str, "news") == 0) {
		conf.log_facility = LOG_NEWS;
	} else if (strcasecmp(cmd->data.str, "syslog") == 0) {
		conf.log_facility = LOG_SYSLOG;
	} else if (strcasecmp(cmd->data.str, "user") == 0) {
		conf.log_facility = LOG_USER;
	} else if (strcasecmp(cmd->data.str, "uucp") == 0) {
		conf.log_facility = LOG_UUCP;
	} else if (strcasecmp(cmd->data.str, "local0") == 0) {
		conf.log_facility = LOG_LOCAL0;
	} else if (strcasecmp(cmd->data.str, "local1") == 0) {
		conf.log_facility = LOG_LOCAL1;
	} else if (strcasecmp(cmd->data.str, "local2") == 0) {
		conf.log_facility = LOG_LOCAL2;
	} else if (strcasecmp(cmd->data.str, "local3") == 0) {
		conf.log_facility = LOG_LOCAL3;
	} else if (strcasecmp(cmd->data.str, "local4") == 0) {
		conf.log_facility = LOG_LOCAL4;
	} else if (strcasecmp(cmd->data.str, "local5") == 0) {
		conf.log_facility = LOG_LOCAL5;
	} else if (strcasecmp(cmd->data.str, "local6") == 0) {
		conf.log_facility = LOG_LOCAL6;
	} else if (strcasecmp(cmd->data.str, "local7") == 0) {
		conf.log_facility = LOG_LOCAL7;
	} else {
		fprintf(stderr, "Log facility %s is invalid\n",
			cmd->data.str);
		exit(EXIT_FAILURE);
	}
	
	return NULL;
}

DOTCONF_CB(common_option) {

	struct config_entry *ce, *tmp=NULL;
#ifdef HAVE_FIREDNS
	size_t blacklistlen = 0;
#endif

	if (strcasecmp(cmd->name, "queueno") == 0) {
		conf.queueno = cmd->data.value;
		return NULL;
	}

	ce =  malloc(sizeof(struct config_entry));
	if (ce == NULL) {
		return NULL;
	}

	ce->string = (char *)strdup(cmd->data.str);
	ce->next = NULL;

	if (strcasecmp(cmd->name, "blacklistbl") == 0) {

#ifdef HAVE_FIREDNS
		blacklistlen = strlen(ce->string);
		if (ce->string[blacklistlen-1] == '.') {
			ce->string[blacklistlen-1]='\0';
		}
#endif

		/* resolution check completely removed.  Will put it back
		 * during config file and architectural revamp. */
		if (blacklistbl == NULL) {
			blacklistbl = ce;
			return NULL;
		} else {
			tmp = blacklistbl;
		}
	}

	if (strcasecmp(cmd->name, "whitelistbl") == 0) {

#ifdef HAVE_FIREDNS
		blacklistlen = strlen(ce->string);
		if (ce->string[blacklistlen-1] == '.') {
			ce->string[blacklistlen-1]='\0';
		}
#endif

		/* resolution check completely removed.  Will put it back
		 * during config file and architectural revamp. */
		if (whitelistbl == NULL) {
			whitelistbl = ce;
			return NULL;
		} else {
			tmp = whitelistbl;
		}
	}

	if (strcasecmp(cmd->name, "whitelist") == 0) {
		if (parse_cidr(ce) == -1) {
			fprintf(stderr, "Error parsing CIDR in %s, ignoring\n",
				ce->string);
			free(ce->string);
			free(ce);
			return NULL;
		}
		if (whitelist == NULL) {
			whitelist = ce;
			return NULL;
		} else {
			tmp = whitelist;
		}
	}

	if (strcasecmp(cmd->name, "blacklist") == 0) {
		if (parse_cidr(ce) == -1) {
			fprintf(stderr, "Error parsing CIDR in %s, ignoring\n",
				ce->string);
			free(ce->string);
			free(ce);
			return NULL;
		}
		if (blacklist == NULL) {
			blacklist = ce;
			return NULL;
		} else {
			tmp = blacklist;
		}
	}

	while (tmp->next != NULL) {
		tmp = tmp->next;
	}

	tmp->next = ce;

	return NULL;

}

DOTCONF_CB(host_section_open) {
	
	struct bl_context *context = (struct bl_context *)ctx;
	const char *old_end_token = context->current_end_token;
	int old_override = context->permissions;
	const char *err = NULL;

	context->permissions |= O_HOSTSECTION;
	context->current_end_token = end_host;

	while (!cmd->configfile->eof) {
		err = dotconf_command_loop_until_error(cmd->configfile);
		if (!err) {
			err = "</host> is missing";
			break;
		}
	
		if (err == context->current_end_token)
			break;
	
		dotconf_warning(cmd->configfile, DCLOG_ERR, 0, err);
	}

	context->current_end_token = old_end_token;
	context->permissions = old_override;

	if (err != end_host)
		return err;

	return NULL;

}

/*
 * SYNOPSIS:
 *   int parse_cidr(
 *                  struct config_entry *ce
 *                 );