/*

 * Copyright (c) 2015 Sunil Nimmagadda <sunil@openbsd.org>

 * Copyright (c) 2012 - 2015 Reyk Floeter <reyk@openbsd.org>

 *

 * Permission to use, copy, modify, and distribute this software for any

 * purpose with or without fee is hereby granted, provided that the above

 * copyright notice and this permission notice appear in all copies.

 *

 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 */

#include <err.h>

#include <fcntl.h>

#include <libgen.h>

#include <limits.h>

#include <stdio.h>

#include <stdint.h>

#include <stdlib.h>

#include <string.h>

#include <strings.h>

#include <unistd.h>

#ifndef NOSSL

#include <tls.h>

#endif /* NOSSL */

#include "ftp.h"

#include "xmalloc.h"

#define MAX_REDIRECTS		10

#ifndef NOSSL

#define MINBUF			128

static struct tls_config	*tls_config;

static struct tls		*ctx;

static int			 tls_session_fd = -1;

static char * const		 tls_verify_opts[] = {

#define HTTP_TLS_CAFILE		0

	"cafile",

#define HTTP_TLS_CAPATH		1

	"capath",

#define HTTP_TLS_CIPHERS	2

	"ciphers",

#define HTTP_TLS_DONTVERIFY	3

	"dont",

#define HTTP_TLS_VERIFYDEPTH	4

	"depth",

#define HTTP_TLS_MUSTSTAPLE	5

	"muststaple",

#define HTTP_TLS_NOVERIFYTIME	6

	"noverifytime",

#define HTTP_TLS_SESSION	7

	"session",

#define HTTP_TLS_DOVERIFY	8

	"do",

	NULL

};

#endif /* NOSSL */

/*

 * HTTP status codes based on IANA assignments (2014-06-11 version):

 * https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml

 * plus legacy (306) and non-standard (420).

 */

static struct http_status {

	int		 code;

	const char	*name;

} http_status[] = {

	{ 100,	"Continue" },

	{ 101,	"Switching Protocols" },

	{ 102,	"Processing" },

	/* 103-199 unassigned */

	{ 200,	"OK" },

	{ 201,	"Created" },

	{ 202,	"Accepted" },

	{ 203,	"Non-Authoritative Information" },

	{ 204,	"No Content" },

	{ 205,	"Reset Content" },

	{ 206,	"Partial Content" },

	{ 207,	"Multi-Status" },

	{ 208,	"Already Reported" },

	/* 209-225 unassigned */

	{ 226,	"IM Used" },

	/* 227-299 unassigned */

	{ 300,	"Multiple Choices" },

	{ 301,	"Moved Permanently" },

	{ 302,	"Found" },

	{ 303,	"See Other" },

	{ 304,	"Not Modified" },

	{ 305,	"Use Proxy" },

	{ 306,	"Switch Proxy" },

	{ 307,	"Temporary Redirect" },

	{ 308,	"Permanent Redirect" },

	/* 309-399 unassigned */

	{ 400,	"Bad Request" },

	{ 401,	"Unauthorized" },

	{ 402,	"Payment Required" },

	{ 403,	"Forbidden" },

	{ 404,	"Not Found" },

	{ 405,	"Method Not Allowed" },

	{ 406,	"Not Acceptable" },

	{ 407,	"Proxy Authentication Required" },

	{ 408,	"Request Timeout" },

	{ 409,	"Conflict" },

	{ 410,	"Gone" },

	{ 411,	"Length Required" },

	{ 412,	"Precondition Failed" },

	{ 413,	"Payload Too Large" },

	{ 414,	"URI Too Long" },

	{ 415,	"Unsupported Media Type" },

	{ 416,	"Range Not Satisfiable" },

	{ 417,	"Expectation Failed" },

	{ 418,	"I'm a teapot" },

	/* 419-421 unassigned */

	{ 420,	"Enhance Your Calm" },

	{ 422,	"Unprocessable Entity" },

	{ 423,	"Locked" },

	{ 424,	"Failed Dependency" },

	/* 425 unassigned */

	{ 426,	"Upgrade Required" },

	/* 427 unassigned */

	{ 428,	"Precondition Required" },

	{ 429,	"Too Many Requests" },

	/* 430 unassigned */

	{ 431,	"Request Header Fields Too Large" },

	/* 432-450 unassigned */

	{ 451,	"Unavailable For Legal Reasons" },

	/* 452-499 unassigned */

	{ 500,	"Internal Server Error" },

	{ 501,	"Not Implemented" },

	{ 502,	"Bad Gateway" },

	{ 503,	"Service Unavailable" },

	{ 504,	"Gateway Timeout" },

	{ 505,	"HTTP Version Not Supported" },

	{ 506,	"Variant Also Negotiates" },

	{ 507,	"Insufficient Storage" },

	{ 508,	"Loop Detected" },

	/* 509 unassigned */

	{ 510,	"Not Extended" },

	{ 511,	"Network Authentication Required" },

	/* 512-599 unassigned */

	{ 0,	NULL },

};

struct http_headers {

	char	*location;

	off_t	 content_length;

	int	 chunked;

	int	 retry_after;

};

static void		 decode_chunk(int, uint, FILE *);

static char		*header_lookup(const char *, const char *);

static const char	*http_error(int);

static int		 http_status_cmp(const void *, const void *);

static void		 http_headers_free(struct http_headers *);

static ssize_t		 http_getline(int, char **, size_t *);

static void		 http_proxy_connect(struct url *, struct url *);

static char		*http_prepare_request(struct url *, off_t *);

static size_t		 http_read(int, char *, size_t);

static struct url	*http_redirect(struct url *, char *);

static void		 http_copy_chunks(struct url *, FILE *, off_t *);

static int		 http_request(int, const char *,

			    struct http_headers **);

static char		*relative_path_resolve(const char *, const char *);

#ifndef NOSSL

static void		 tls_copy_file(struct url *, FILE *, off_t *);

static ssize_t		 tls_getline(char **, size_t *, struct tls *);

#endif /* NOSSL */

static FILE		*fp;

static int		 chunked;

void

http_connect(struct url *url, int timeout)

{

	static struct url	*proxy;

	const char		*host, *port;

	int			 sock;

	proxy = (url->scheme == S_HTTPS || url->scheme == S_HTTP) ?

	    http_proxy : ftp_proxy;

	host = proxy ? proxy->host : url->host;

	port = proxy ? proxy->port : url->port;

	if ((sock = tcp_connect(host, port, timeout)) == -1)

		exit(1);

	if ((fp = fdopen(sock, "r+")) == NULL)

		err(1, "%s: fdopen", __func__);

	if (proxy)

		http_proxy_connect(proxy, url);

#ifndef NOSSL

	if (url->scheme != S_HTTPS)

		return;

	if ((ctx = tls_client()) == NULL)

		errx(1, "failed to create tls client");

	if (tls_configure(ctx, tls_config) != 0)

		errx(1, "%s: %s", __func__, tls_error(ctx));

	if (tls_connect_socket(ctx, fileno(fp), url->host) != 0)

		errx(1, "%s: %s", __func__, tls_error(ctx));

#endif /* NOSSL */

}

static void

http_proxy_connect(struct url *proxy, struct url *url)

{

	struct http_headers	*headers;

	char			*auth = NULL, *req;

	int			 authlen = 0, code;

	if (proxy->basic_auth) {

		authlen = xasprintf(&auth,

		    "Proxy-Authorization: Basic %s\r\n", proxy->basic_auth);

	}

	xasprintf(&req,

	    "CONNECT %s:%s HTTP/1.0\r\n"

	    "User-Agent: %s\r\n"

	    "%s"

	    "\r\n",

	    url->host, url->port,

	    useragent,

	    proxy->basic_auth ? auth : "");

	freezero(auth, authlen);

	if ((code = http_request(S_HTTP, req, &headers)) != 200)

		errx(1, "%s: Failed to CONNECT to %s:%s: %d %s",

			__func__, url->host, url->port, code, http_error(code));

	free(req);

	http_headers_free(headers);

}

static char *

http_prepare_request(struct url *url, off_t *offset)

{

	char	*auth = NULL, *path = NULL, *range = NULL, *req;

	int	 authlen = 0;

	if (*offset)

		xasprintf(&range, "Range: bytes=%lld-\r\n", *offset);

	if (url->basic_auth) {

		authlen = xasprintf(&auth,

		    "Authorization: Basic %s\r\n", url->basic_auth);

	}

	if (url->path)

		path = url_encode(url->path);

	xasprintf(&req,

	    "GET %s HTTP/1.1\r\n"

	    "Host: %s\r\n"

	    "%s"

	    "%s"

	    "Connection: close\r\n"

	    "User-Agent: %s\r\n"

	    "\r\n",

	    path ? path : "/",

	    url->host,

	    *offset ? range : "",

	    url->basic_auth ? auth : "",

	    useragent);

	free(range);

	freezero(auth, authlen);

	free(path);

	return req;

}

struct url *

http_get(struct url *url, off_t *offset, off_t *sz)

{

	struct http_headers	*headers;

	char			*req;

	int			 code, redirects = 0, retry = 0;

	do {

		log_request("Requesting", url, http_proxy);

		req = http_prepare_request(url, offset);

		code = http_request(url->scheme, req, &headers);

		free(req);

		switch (code) {

		case 200:

			if (*offset) {

				warnx("Server does not support resume.");

				*offset = 0;

			}

			break;

		case 206:

			break;

		case 301:

		case 302:

		case 303:

		case 307:

			http_close(url);

			if (++redirects > MAX_REDIRECTS)

				errx(1, "Too many redirections requested.");

			if (headers->location == NULL) {

				errx(1,

				    "%s: Location header missing", __func__);

			}

			url = http_redirect(url, headers->location);

			http_headers_free(headers);

			log_request("Redirected to", url, http_proxy);

			http_connect(url, 0);

			break;

		case 416:

			errx(1, "File is already fully retrieved.");

			break;

		case 503:

			if (headers->retry_after == 0 && retry == 0) {

				http_close(url);

				http_headers_free(headers);

				retry = 1;

				log_request("Retrying", url, http_proxy);

				http_connect(url, 0);

				break;

			}

			/* FALLTHROUGH */

		default:

			errx(1, "Error retrieving file: %d %s",

			    code, http_error(code));

		}

	} while (code == 301 || code == 302 ||

	    code == 303 || code == 307 || code == 503);

	*sz = headers->content_length + *offset;

	chunked = headers->chunked;

	http_headers_free(headers);

	return url;

}

void

http_save(struct url *url, FILE *dst_fp, off_t *offset)

{

	if (chunked)

		http_copy_chunks(url, dst_fp, offset);

#ifndef NOSSL

	else if (url->scheme == S_HTTPS)

		tls_copy_file(url, dst_fp, offset);

#endif /* NOSSL */

	else

		copy_file(dst_fp, fp, offset);

}

static struct url *

http_redirect(struct url *old_url, char *location)

{

	struct url	*new_url;

	/* absolute uri reference */

	if (strncasecmp(location, "http", 4) == 0 ||