/*
 *
 * (C) 2013-25 - ntop.org
 *
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 */

#include "ntop_includes.h"
#include "flow_alerts_includes.h"

/*
  #define DEBUG_IEC60870
  #define IEC60870_TRACE
*/

#define CLIENT_ALERT_SCORE 90
#define SERVER_ALERT_SCORE 10

/* *************************************** */

IEC104Stats::IEC104Stats() {
  if(trace_new_delete) ntop->getTrace()->traceEvent(TRACE_NORMAL, "[new] %s", __FILE__);
  
  memset(&pkt_lost, 0, sizeof(pkt_lost));
  last_type_i = 0;
  memset(&last_i_apdu, 0, sizeof(last_i_apdu));
  memset(&stats, 0, sizeof(stats));
  memset(&transitions, 0, sizeof(transitions));

  i_s_apdu = ndpi_alloc_data_analysis(32 /* sliding window side */);
  tx_seq_num = rx_seq_num = 0, infobuf[0] = '\0';
  invalid_command_transition_detected = false;
}

/* *************************************** */

IEC104Stats::~IEC104Stats() {
  if(trace_new_delete) ntop->getTrace()->traceEvent(TRACE_NORMAL, "[new] %s", __FILE__);
  ndpi_free_data_analysis(i_s_apdu, 1);
}

/* *************************************** */

void IEC104Stats::processPacket(Flow *f, bool tx_direction,
                                const u_char *payload, u_int16_t payload_len,
				const struct pcap_pkthdr *h) {
  if ((payload_len >= 6) && (payload[0] == 0x68 /* IEC magic byte */)) {
    u_int offset = 1 /* Skip magic byte */;
    u_int64_t *allowedTypeIDs = ntop->getPrefs()->getIEC104AllowedTypeIDs();
    std::unordered_map<u_int16_t, u_int32_t>::iterator it;

    lock.wrlock(__FILE__, __LINE__);

    if (tx_direction)
      stats.forward_msgs++;
    else
      stats.reverse_msgs++;

    while ((offset+1) /* Skip START byte */ < payload_len) {
      /* https://infosys.beckhoff.com/english.php?content=../content/1033/tcplclibiec870_5_104/html/tcplclibiec870_5_104_objref_overview.htm&id
       */
      u_int8_t len = payload[offset];
      u_int8_t pdu_type = ((payload[offset + 1] & 0x01) == 0) ? 0 : (payload[offset + 1] & 0x03);

#ifdef DEBUG_IEC60870
      ntop->getTrace()->traceEvent(TRACE_WARNING, "[%s] %02X %02X %02X %02X",
                                   __FUNCTION__, payload[offset - 1],
                                   payload[offset], payload[offset + 1],
                                   payload[offset + 2]);
#endif

#ifdef DEBUG_IEC60870
      ntop->getTrace()->traceEvent(
          TRACE_WARNING, "[%s] A-PDU Len %u/%u [pdu_type: %u][magic: %02X]",
          __FUNCTION__, len, payload_len, pdu_type, payload[offset - 1]);
#endif

      if (len == 0) break; /* Something went wrong */

      switch (pdu_type) {
        case 0x03: /* U */
	{
          u_int8_t u_type = (payload[offset + 1] & 0xFC) >> 2;
          const char *u_type_str;

#ifdef IEC60870_TRACE
          ntop->getTrace()->traceEvent(TRACE_NORMAL, "A-PDU U-%u",
                                       (payload[offset + 1] & 0xFC) >> 2);
#endif
          /* No rx and tx to be updated */
          stats.type_u++;

          switch (u_type) {
            case 0x01:
              u_type_str = "STARTDT act";
              break;

            case 0x02:
              u_type_str = "STARTDT con";
              break;

            case 0x04:
              u_type_str = "STOPDT act";
              break;

            case 0x08:
              u_type_str = "STOPDT con";
              break;

            case 0x10:
              u_type_str = "TESTFR act";
              break;

            case 0x20:
              u_type_str = "TESTFR con";
              break;

            default:
              u_type_str = "???";
              break;
          }

          snprintf(infobuf, sizeof(infobuf) - 1, "%s U (%s)",
                   tx_direction ? "->" : "<-", u_type_str);
        }
	break;

        case 0x01: /* S */
	  if((offset+4) < payload_len) {
	    if (len >= 4) {
	      u_int16_t rx = ((((u_int16_t)payload[offset + 4]) << 8) + payload[offset + 3]) >> 1;

	      if (last_i_apdu.tv_sec != 0) {
		float ms = Utils::msTimevalDiff(&h->ts, &last_i_apdu);

#ifdef IEC60870_TRACE
		ntop->getTrace()->traceEvent(
                  TRACE_NORMAL,
                  "A-PDU S [last I-TX: %u][S RX ack: %u][tdiff: %.2f msec]",
                  tx_seq_num, rx, ms);
#endif
		/*
		  In theory if all is in good shape
		  (rx + 1) == tx_seq_num
		*/

		ndpi_data_add_value(i_s_apdu, ms);
	      }

	      /* No rx and tx to be updated */
	      snprintf(infobuf, sizeof(infobuf) - 1, "%s S, RX %u",
		       tx_direction ? "->" : "<-", rx);
	    }

	    stats.type_s++;
	  }
          break;
      }

      if (pdu_type != 0x0 /* Type I */) {
        offset += len + 2;
        stats.type_other++;
        continue;
      }

      /* From now on, only Type I packets are processed */
      memcpy(&last_i_apdu, &h->ts, sizeof(struct timeval));
      stats.type_i++;

      if(((offset + 6) < payload_len) && (len >= 6 /* Ignore 4 bytes APDUs */)) {
        u_int16_t rx_value, tx_value;
        bool initial_run = ((rx_seq_num == 0) && (tx_seq_num == 0)) ? true : false;

        tx_value = ((((u_int16_t)payload[offset + 2]) << 8) + payload[offset + 1]) >> 1;
        rx_value = ((((u_int16_t)payload[offset + 4]) << 8) + payload[offset + 3]) >> 1;

        if (!tx_direction) {
          /* Counters are swapped */
          u_int16_t v = rx_value;

          rx_value = tx_value;
          tx_value = v;
        }

        if ((tx_value == tx_seq_num) && (rx_value == rx_seq_num)) {
          stats.retransmitted_msgs++;
          lock.unlock(__FILE__, __LINE__);
          return;
        }

        if (!initial_run) {
          u_int32_t diff = abs(tx_value - (tx_seq_num + 1));

          /* Check for id reset (16 bit only) */
          if (diff != 32768) pkt_lost.tx += diff;
        }
        tx_seq_num = tx_value;

        if (!tx_direction) {
          if (!initial_run) {
            u_int32_t diff = abs(rx_value - rx_seq_num);

            /* Check for id reset (16 bit only) */
            if (diff != 32768) pkt_lost.rx += diff;
          }

          rx_value++; /* The next RX will be increased by 1 */
        } else {
          if (!initial_run) {
            u_int32_t diff = abs(rx_value - rx_seq_num);

            /* Check for id reset (16 bit only) */
            if (diff != 32768) pkt_lost.rx += diff;
          }
        }
        rx_seq_num = rx_value;

        /* Skip magic(1), len(1), type/TX(2), RX(2) = 6 */
        len -= 6 /* Skip magic and len */,
	  offset += 5 /* magic already skept */;

        if (payload_len >= (offset + len)) {
          u_int8_t type_id = payload[offset];
          u_int8_t cause_tx = payload[offset + 1] & 0x3F;
          u_int8_t negative =
              ((payload[offset + 1] & 0x40) == 0x40) ? true : false;
          u_int16_t asdu;
          u_int64_t bit;
          bool unexpected_typeid_alerted = false;

          offset += len + 2 /* magic and len */;

          if((len >= 6) && ((offset + 6) <= payload_len))
            asdu = /* ntohs */ (*((u_int16_t *)&payload[4 + offset]));
          else
            asdu = 0;

#ifdef DEBUG_IEC60870
          ntop->getTrace()->traceEvent(
              TRACE_WARNING, "[%s] TypeId %u [offset %u/%u]", __FUNCTION__,
              type_id, offset, payload_len);
#endif

#ifdef IEC60870_TRACE
          ntop->getTrace()->traceEvent(
              TRACE_NORMAL,
              "[%s] A-PDU I-%-3u [rx: %u][tx: %u][lost rx/tx: %u/%u]",
              tx_direction ? "->" : "<-", type_id, rx_seq_num, tx_seq_num,
              pkt_lost.rx, pkt_lost.tx);
#endif

          snprintf(infobuf, sizeof(infobuf) - 1, "%s I, RX %u, TX %u",
                   tx_direction ? "->" : "<-", rx_seq_num, tx_seq_num);

          if (!initial_run) {
            u_int32_t transition = (last_type_i << 8) + type_id;

            it = type_i_transitions.find(transition);

            if (it == type_i_transitions.end()) {
              if (f->get_duration() > ntop->getPrefs()->getIEC60870LearingPeriod()) {
                FlowAlert *alert = NULL;
                u_int16_t c_score = 50, s_score = 10;

#ifdef IEC60870_TRACE
                ntop->getTrace()->traceEvent(TRACE_NORMAL,
                                             "Found new transition %u -> %u",
                                             last_type_i, type_id);
#endif
                char key[128], rsp[64];
                snprintf(key, sizeof(key), CHECKS_IEC_INVALID_TRANSITION);

                if ((!ntop->getRedis()->get(key, rsp, sizeof(rsp))) &&
                    ((rsp[0] != '\0') && (!strcmp(rsp, "1"))))
                  alert = new IECInvalidTransitionAlert(NULL, f,
							(struct timeval*)&h->ts,
                                                        last_type_i, type_id);

                if (alert) {
                  alert->setCliSrvScores(c_score, s_score);
                  f->triggerAlert(alert, true);
                }

                type_i_transitions[transition] = 2; /* Post Learning */
              } else
                type_i_transitions[transition] = 1; /* During Learning */
            } else
              type_i_transitions[transition] = it->second + 1;
          }

          if (!initial_run) {
            if (isMonitoringTypeId(last_type_i) && isMonitoringTypeId(type_id))
              transitions.m_to_m++;
            else if (isMonitoringTypeId(last_type_i) &&
                     isCommandTypeId(type_id))
              transitions.m_to_c++;
            else if (isCommandTypeId(last_type_i) &&
                     isMonitoringTypeId(type_id))
              transitions.c_to_m++;
            else if (isCommandTypeId(last_type_i) && isCommandTypeId(type_id))
              transitions.c_to_c++;

            if ((invalid_command_transition_detected == false) &&
                ((transitions.m_to_c > 20) || (transitions.c_to_m > 20) ||
                 (transitions.c_to_c > 5))) {
              /* https://github.com/ntop/ntopng/issues/6598 */
              FlowAlert *alert = NULL;
              u_int16_t c_score = CLIENT_ALERT_SCORE,
                        s_score = SERVER_ALERT_SCORE;

              char key[128], rsp[64];
              snprintf(key, sizeof(key), CHECKS_IEC_INVALID_COMMAND_TRANSITION);

              if ((!ntop->getRedis()->get(key, rsp, sizeof(rsp))) &&
                  ((rsp[0] != '\0') && (!strcmp(rsp, "1"))))
                alert = new IECInvalidCommandTransitionAlert(NULL, f,
							     (struct timeval*)&h->ts, transitions.m_to_c,
							     transitions.c_to_m, transitions.c_to_c);

              if (alert) {
                alert->setCliSrvScores(c_score, s_score);
                f->triggerAlert(alert, true);
              }

              // ntop->getTrace()->traceEvent(TRACE_WARNING, "*** INVALID
              // TRANSITION %u -> %u", last_type_i, type_id);

              invalid_command_transition_detected = true;
            }
          }

          last_type_i = type_id;

          it = typeid_uses.find(type_id);

          if (it == typeid_uses.end())
            typeid_uses[type_id] = 1;
          else
            typeid_uses[type_id] = it->second + 1;

          if (type_id < 64) {
            bit = ((u_int64_t)1) << type_id;
            if ((allowedTypeIDs[0] & bit) == 0)
              unexpected_typeid_alerted = true;
          } else if (type_id < 128) {
            bit = ((u_int64_t)1) << (type_id - 64);

            if ((allowedTypeIDs[1] & bit) == 0)
              unexpected_typeid_alerted = true;
          }

          if (unexpected_typeid_alerted) {
            FlowAlert *alert = NULL;
            u_int16_t c_score = CLIENT_ALERT_SCORE,
                      s_score = SERVER_ALERT_SCORE;

            char key[128], rsp[64];
            snprintf(key, sizeof(key), CHECKS_IEC_UNEXPECTED_TYPE_ID);

            if ((!ntop->getRedis()->get(key, rsp, sizeof(rsp))) &&
                ((rsp[0] != '\0') && (!strcmp(rsp, "1"))))
              alert = new IECUnexpectedTypeIdAlert(NULL, f, type_id, asdu,
                                                   cause_tx, negative);

            if (alert) {
              alert->setCliSrvScores(c_score, s_score);
              f->triggerAlert(alert, true);
            }
          } /* unexpected_typeid_alerted */
          /* Discard typeIds 127..255 */
        } else /* payload_len < len */
          break;
      } else {
        // ntop->getTrace()->traceEvent(TRACE_WARNING, "*** short APDUs");
        break;
      }
      
      if((offset < payload_len) && (payload[offset] == 0x68 /* IEC magic byte */))
        offset += 1; /* We skip the initial magic byte */
      else {
#ifdef DEBUG_IEC60870
        ntop->getTrace()->traceEvent(
            TRACE_WARNING, "Skipping IEC entry: no magic byte @ offset %u",
            offset);
#endif
        break;
      }
    } /* while */

    lock.unlock(__FILE__, __LINE__);
  }
}

/* *************************************** */

void IEC104Stats::lua(lua_State *vm) {
  lua_newtable(vm);

  lock.rdlock(__FILE__, __LINE__);

  /* *************************** */

  lua_newtable(vm);

  for (std::unordered_map<u_int16_t, u_int32_t>::iterator it = typeid_uses.begin();
       it != typeid_uses.end(); ++it) {
    char buf[8];

    snprintf(buf, sizeof(buf), "%u", it->first);
    lua_push_int32_table_entry(vm, buf, it->second);
  }

  lua_pushstring(vm, "typeid");
  lua_insert(vm, -2);
  lua_settable(vm, -3);

  /* *************************** */

  lua_newtable(vm);

  for (std::unordered_map<u_int16_t, u_int32_t>::iterator it =
           type_i_transitions.begin();
       it != type_i_transitions.end(); ++it) {
    char buf[8];

    snprintf(buf, sizeof(buf), "%u,%u", (it->first >> 8), it->first & 0xFF);
    lua_push_int32_table_entry(vm, buf, it->second);
  }

  lua_pushstring(vm, "typeid_transitions");
  lua_insert(vm, -2);
  lua_settable(vm, -3);

  lock.unlock(__FILE__, __LINE__);

  /* *************************** */

  lua_newtable(vm);
  lua_push_int32_table_entry(vm, "type_i", stats.type_i);
  lua_push_int32_table_entry(vm, "type_s", stats.type_s);
  lua_push_int32_table_entry(vm, "type_u", stats.type_u);
  lua_push_int32_table_entry(vm, "type_other", stats.type_other);
  lua_push_int32_table_entry(vm, "forward_msgs", stats.forward_msgs);
  lua_push_int32_table_entry(vm, "reverse_msgs", stats.reverse_msgs);
  lua_push_int32_table_entry(vm, "retransmitted_msgs",
                             stats.retransmitted_msgs);
  lua_pushstring(vm, "stats");
  lua_insert(vm, -2);
  lua_settable(vm, -3);

  /* *************************** */

  lua_newtable(vm);
  lua_push_int32_table_entry(vm, "rx", pkt_lost.rx);
  lua_push_int32_table_entry(vm, "tx", pkt_lost.tx);
  lua_pushstring(vm, "pkt_lost");
  lua_insert(vm, -2);
  lua_settable(vm, -3);

  /* *************************** */

  lua_newtable(vm);
  lua_push_float_table_entry(vm, "average", ndpi_data_average(i_s_apdu));
  lua_push_float_table_entry(vm, "stddev", ndpi_data_stddev(i_s_apdu));
  lua_pushstring(vm, "ack_time");
  lua_insert(vm, -2);
  lua_settable(vm, -3);

  /* *************************** */

  lua_pushstring(vm, "iec104");
  lua_insert(vm, -2);
  lua_settable(vm, -3);
}

/* *************************************** */

std::string IEC104Stats::getFlowInfo() {
  lock.rdlock(__FILE__, __LINE__);
  std::string info_field = std::string(infobuf);
  lock.unlock(__FILE__, __LINE__);

  return info_field;
}

/* *************************************** */

bool IEC104Stats::isMonitoringTypeId(u_int16_t tid) {
  return (((tid <= 40) || (tid == 70)) ? true : false);
}

/* *************************************** */

bool IEC104Stats::isCommandTypeId(u_int16_t tid) {
  if (((tid >= 45) && (tid <= 64)) || ((tid >= 100) && (tid <= 107)))
    return (true);
  else
    return (false);
}

/* *************************************** */
