//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2012-2020 OpenVPN Inc.
//
//    This program is free software: you can redistribute it and/or modify
//    it under the terms of the GNU Affero General Public License Version 3
//    as published by the Free Software Foundation.
//
//    This program is distributed in the hope that it will be useful,
//    but WITHOUT ANY WARRANTY; without even the implied warranty of
//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
//    GNU Affero General Public License for more details.
//
//    You should have received a copy of the GNU Affero General Public License
//    along with this program in the COPYING file.
//    If not, see <http://www.gnu.org/licenses/>.

// DNS utilities for Mac

#ifndef OPENVPN_TUN_MAC_MACDNS_WATCHDOG_H
#define OPENVPN_TUN_MAC_MACDNS_WATCHDOG_H

#include <thread>
#include <mutex>

#include <openvpn/log/logthread.hpp>
#include <openvpn/common/action.hpp>
#include <openvpn/apple/cf/cftimer.hpp>
#include <openvpn/apple/cf/cfrunloop.hpp>
#include <openvpn/tun/mac/macdns.hpp>

namespace openvpn {
  OPENVPN_EXCEPTION(macdns_watchdog_error);

  class MacDNSWatchdog : public RC<thread_unsafe_refcount>
  {
  public:
    typedef RCPtr<MacDNSWatchdog> Ptr;

    // flags
    enum {
      ENABLE_WATCHDOG  = (1<<0),
      SYNCHRONOUS      = (1<<1),
      FLUSH_RECONFIG   = (1<<2),
    };

    class DNSAction : public Action
    {
    public:
      typedef RCPtr<DNSAction> Ptr;

      DNSAction(const MacDNSWatchdog::Ptr& parent_arg,
		const MacDNS::Config::Ptr& config_arg,
		const unsigned int flags_arg)
	: parent(parent_arg),
	  config(config_arg),
	  flags(flags_arg)
      {
      }

      virtual void execute(std::ostream& os)
      {
	os << to_string() << std::endl;
	if (parent)
	  parent->setdns(config, flags);
      }

      virtual std::string to_string() const
      {
	std::ostringstream os;
	os << "MacDNSAction: FLAGS=";
	if (flags & ENABLE_WATCHDOG)
	  os << 'E';
	if (flags & SYNCHRONOUS)
	  os << 'S';
	if (flags & FLUSH_RECONFIG)
	  os << 'F';
	if (config)
	  os << ' ' << config->to_string();
	return os.str();
      }

    private:
      const MacDNSWatchdog::Ptr parent;
      const MacDNS::Config::Ptr config;
      const unsigned int flags;
    };

    MacDNSWatchdog()
      : macdns(new MacDNS("OpenVPNConnect")),
	thread(nullptr)
    {
    }

    virtual ~MacDNSWatchdog()
    {
      stop_thread();
    }

    static void add_actions(const MacDNS::Config::Ptr& dns,
			    const unsigned int flags,
			    ActionList& create,
			    ActionList& destroy)
    {
      MacDNSWatchdog::Ptr watchdog(new MacDNSWatchdog);
      MacDNS::Config::Ptr dns_remove;
      DNSAction::Ptr create_action(new DNSAction(watchdog, dns, flags));
      DNSAction::Ptr destroy_action(new DNSAction(watchdog, dns_remove, flags));
      create.add(create_action);
      destroy.add(destroy_action);
    }

  private:
    bool setdns(const MacDNS::Config::Ptr& config, const unsigned int flags)
    {
      bool mod = false;
      if (config)
	{
	  if ((flags & SYNCHRONOUS) || !(flags & ENABLE_WATCHDOG))
	    stop_thread();
	  config_ = config;
	  if (flags & ENABLE_WATCHDOG)
	    {
	      if (!thread)
		{
		  mod = macdns->setdns(*config_);
		  thread = new std::thread(&MacDNSWatchdog::thread_func, this);
		}
	      else
		{
		  if (runloop.defined())
		    schedule_push_timer(0);
		  else
		    OPENVPN_LOG("MacDNSWatchdog::setdns: runloop undefined");
		}
	    }
	  else
	    {
	      mod = macdns->setdns(*config_);
	    }
	}
      else
	{
	  stop_thread();
	  config_.reset();
	  mod = macdns->resetdns();
	}
      if (mod && (flags & FLUSH_RECONFIG))
	{
	  macdns->flush_cache();
	  macdns->signal_network_reconfiguration();
	}
      return mod;
    }

    std::string to_string() const
    {
      const MacDNS::Config::Ptr config(config_);
      if (config)
	return config->to_string();
      else
	return std::string("UNDEF");
    }

    void stop_thread()
    {
      if (thread)
	{
	  if (runloop.defined())
	    CFRunLoopStop(runloop());
	  thread->join();
	  delete thread;
	  thread = nullptr;
	}
    }

    // All methods below this point called in the context of watchdog thread
    // except for schedule_push_timer which may be called from parent thread
    // as well.
    void thread_func()
    {
      runloop.reset(CFRunLoopGetCurrent(), CF::GET);
      Log::Context logctx(logwrap);

      try {
	SCDynamicStoreContext context = {0, this, nullptr, nullptr, nullptr};
	CF::DynamicStore ds(SCDynamicStoreCreate(kCFAllocatorDefault,
						 CFSTR("OpenVPN_MacDNSWatchdog"),
						 callback_static,
						 &context));
	if (!ds.defined())
	  throw macdns_watchdog_error("SCDynamicStoreCreate");
	const CF::Array watched_keys(macdns->dskey_array());
	if (!watched_keys.defined())
	  throw macdns_watchdog_error("watched_keys is undefined");
	if (!SCDynamicStoreSetNotificationKeys(ds(),
					       watched_keys(),
					       nullptr))
	  throw macdns_watchdog_error("SCDynamicStoreSetNotificationKeys failed");
	CF::RunLoopSource rls(SCDynamicStoreCreateRunLoopSource(kCFAllocatorDefault, ds(), 0));
	if (!rls.defined())
	  throw macdns_watchdog_error("SCDynamicStoreCreateRunLoopSource failed");
	CFRunLoopAddSource(CFRunLoopGetCurrent(), rls(), kCFRunLoopDefaultMode);

	// process event loop until CFRunLoopStop is called from parent thread
	CFRunLoopRun();
      }
      catch (const std::exception& e)
	{
	  OPENVPN_LOG("MacDNSWatchdog::thread_func exception: " << e.what());
	}
      cancel_push_timer();
    }

    static void callback_static(SCDynamicStoreRef store, CFArrayRef changedKeys, void *arg)
    {
      MacDNSWatchdog *self = (MacDNSWatchdog *)arg;
      self->callback(store, changedKeys);
    }

    void callback(SCDynamicStoreRef store, CFArrayRef changedKeys)
    {
      // DNS Watchdog delay from the time that change is detected
      // to when we forcibly revert it (seconds).
      schedule_push_timer(1);
    }

    void schedule_push_timer(const int seconds)
    {
      std::lock_guard<std::mutex> lock(push_timer_lock);
      CFRunLoopTimerContext context = { 0, this, nullptr, nullptr, nullptr };
      cancel_push_timer_nolock();
      push_timer.reset(CFRunLoopTimerCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + seconds, 0, 0, 0, push_timer_callback_static, &context));
      if (push_timer.defined())
	CFRunLoopAddTimer(runloop(), push_timer(), kCFRunLoopCommonModes);
      else
	OPENVPN_LOG("MacDNSWatchdog::schedule_push_timer: failed to create timer");
    }

    void cancel_push_timer_nolock()
    {
      if (push_timer.defined())
	{
	  CFRunLoopTimerInvalidate(push_timer());
	  push_timer.reset(nullptr);
	}
    }

    void cancel_push_timer()
    {
      std::lock_guard<std::mutex> lock(push_timer_lock);
      cancel_push_timer_nolock();
    }

    static void push_timer_callback_static(CFRunLoopTimerRef timer, void *info)
    {
      MacDNSWatchdog* self = (MacDNSWatchdog*)info;
      self->push_timer_callback(timer);
    }

    void push_timer_callback(CFRunLoopTimerRef timer)
    {
      try {
	// reset DNS settings after watcher detected modifications by third party
	const MacDNS::Config::Ptr config(config_);
	if (macdns->setdns(*config))
	  OPENVPN_LOG("MacDNSWatchdog: updated DNS settings");
      }
      catch (const std::exception& e)
	{
	  OPENVPN_LOG("MacDNSWatchdog::push_timer_callback exception: " << e.what());
	}
    }


    MacDNS::Config::Ptr config_;
    MacDNS::Ptr macdns;

    std::thread* thread;            // watcher thread
    CF::RunLoop runloop;           // run loop in watcher thread
    CF::Timer push_timer;          // watcher thread timer
    std::mutex push_timer_lock;
    Log::Context::Wrapper logwrap; // used to carry forward the log context from parent thread
  };
}

#endif