/*-
 * Copyright (c) 2025 Klara, Inc.
 *
 * SPDX-License-Identifier: BSD-2-Clause
 */

#include <sys/param.h>
#include <sys/conf.h>
#include <sys/stat.h>
#include <sys/wait.h>

#include <dlfcn.h>
#include <fcntl.h>
#include <limits.h>
#include <poll.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>

#include "tzdir.h"

#include <atf-c.h>

struct tzcase {
	const char *tzfn;
	const char *expect;
};

static const struct tzcase tzcases[] = {
	/*
	 * A handful of time zones and the expected result of
	 * strftime("%z (%Z)", tm) when that time zone is active
	 * and tm represents a date in the summer of 2025.
	 */
	{ "America/Vancouver",	"-0700 (PDT)"	},
	{ "America/New_York",	"-0400 (EDT)"	},
	{ "Europe/London",	"+0100 (BST)"	},
	{ "Europe/Paris",	"+0200 (CEST)"	},
	{ "Asia/Kolkata",	"+0530 (IST)"	},
	{ "Asia/Tokyo",		"+0900 (JST)"	},
	{ "Australia/Canberra",	"+1000 (AEST)"	},
	{ "UTC",		"+0000 (UTC)"	},
	{ 0 },
};
static const struct tzcase utc = { "UTC", "+0000 (UTC)" };
static const struct tzcase invalid = { "invalid", "+0000 (-00)" };
static const time_t then = 1751328000; /* 2025-07-01 00:00:00 UTC */

static bool debugging;

static void
debug(const char *fmt, ...)
{
	va_list ap;

	if (debugging) {
		va_start(ap, fmt);
		vfprintf(stderr, fmt, ap);
		va_end(ap);
		fputc('\n', stderr);
	}
}

static void
change_tz(const char *tzn)
{
	static const char *zfn = TZDIR;
	static const char *tfn = "root" TZDEFAULT ".tmp";
	static const char *dfn = "root" TZDEFAULT;
	ssize_t clen;
	int zfd, sfd, dfd;

	ATF_REQUIRE((zfd = open(zfn, O_DIRECTORY | O_SEARCH)) >= 0);
	ATF_REQUIRE((sfd = openat(zfd, tzn, O_RDONLY)) >= 0);
	ATF_REQUIRE((dfd = open(tfn, O_CREAT | O_TRUNC | O_WRONLY, 0644)) >= 0);
	do {
		clen = copy_file_range(sfd, NULL, dfd, NULL, SSIZE_MAX, 0);
		ATF_REQUIRE_MSG(clen != -1, "failed to copy %s/%s: %m",
		    zfn, tzn);
	} while (clen > 0);
	ATF_CHECK_EQ(0, close(dfd));
	ATF_CHECK_EQ(0, close(sfd));
	ATF_CHECK_EQ(0, close(zfd));
	ATF_REQUIRE_EQ(0, rename(tfn, dfn));
	debug("time zone %s installed", tzn);
}

static void
test_tz(const char *expect)
{
	char buf[128];
	struct tm *tm;
	size_t len;

	ATF_REQUIRE((tm = localtime(&then)) != NULL);
	len = strftime(buf, sizeof(buf), "%z (%Z)", tm);
	ATF_REQUIRE(len > 0);
	ATF_CHECK_STREQ(expect, buf);
}

ATF_TC(tz_default);
ATF_TC_HEAD(tz_default, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test default zone");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(tz_default, tc)
{
	/* prepare chroot with no /etc/localtime */
	ATF_REQUIRE_EQ(0, mkdir("root", 0755));
	ATF_REQUIRE_EQ(0, mkdir("root/etc", 0755));
	/* enter chroot */
	ATF_REQUIRE_EQ(0, chroot("root"));
	ATF_REQUIRE_EQ(0, chdir("/"));
	/* check timezone */
	unsetenv("TZ");
	test_tz("+0000 (UTC)");
}

ATF_TC(tz_invalid_file);
ATF_TC_HEAD(tz_invalid_file, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test invalid zone file");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(tz_invalid_file, tc)
{
	static const char *dfn = "root/etc/localtime";
	int fd;

	/* prepare chroot with bogus /etc/localtime */
	ATF_REQUIRE_EQ(0, mkdir("root", 0755));
	ATF_REQUIRE_EQ(0, mkdir("root/etc", 0755));
	ATF_REQUIRE((fd = open(dfn, O_RDWR | O_CREAT, 0644)) >= 0);
	ATF_REQUIRE_EQ(8, write(fd, "invalid\n", 8));
	ATF_REQUIRE_EQ(0, close(fd));
	/* enter chroot */
	ATF_REQUIRE_EQ(0, chroot("root"));
	ATF_REQUIRE_EQ(0, chdir("/"));
	/* check timezone */
	unsetenv("TZ");
	test_tz(invalid.expect);
}

ATF_TC(thin_jail);
ATF_TC_HEAD(thin_jail, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test typical thin jail scenario");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(thin_jail, tc)
{
	const struct tzcase *tzcase = tzcases;

	/* prepare chroot */
	ATF_REQUIRE_EQ(0, mkdir("root", 0755));
	ATF_REQUIRE_EQ(0, mkdir("root/etc", 0755));
	change_tz(tzcase->tzfn);
	/* enter chroot */
	ATF_REQUIRE_EQ(0, chroot("root"));
	ATF_REQUIRE_EQ(0, chdir("/"));
	/* check timezone */
	unsetenv("TZ");
	test_tz(tzcase->expect);
}

#ifdef DETECT_TZ_CHANGES
/*
 * Test time zone change detection.
 *
 * The parent creates a chroot containing only /etc/localtime, initially
 * set to UTC.  It then forks a child which enters the chroot, repeatedly
 * checks the current time zone, and prints it to stdout if it changes
 * (including once on startup).  Meanwhile, the parent waits for output
 * from the child.  Every time it receives a line of text from the child,
 * it checks that it is as expected, then changes /etc/localtime within
 * the chroot to the next case in the list.  Once it reaches the end of
 * the list, it closes a pipe to notify the child, which terminates.
 *
 * Note that ATF and / or Kyua may have set the timezone before the test
 * case starts (even unintentionally).  Therefore, we start the test only
 * after we've received and discarded the first report from the child,
 * which should come almost immediately on startup.
 */
static const char *tz_change_interval_sym = "__tz_change_interval";
static int *tz_change_interval_p;
static const int tz_change_interval = 3;
static int tz_change_timeout = 90;

ATF_TC(detect_tz_changes);
ATF_TC_HEAD(detect_tz_changes, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test timezone change detection");
	atf_tc_set_md_var(tc, "require.user", "root");
	atf_tc_set_md_var(tc, "timeout", "600");
}
ATF_TC_BODY(detect_tz_changes, tc)
{
	char obuf[1024] = "";
	char ebuf[1024] = "";
	struct pollfd fds[3];
	int opd[2], epd[2], spd[2];
	time_t changed, now;
	const struct tzcase *tzcase = NULL;
	struct tm *tm;
	size_t olen = 0, elen = 0;
	ssize_t rlen;
	long curoff = LONG_MIN;
	pid_t pid;
	int nfds, status;

	/* speed up the test if possible */
	tz_change_interval_p = dlsym(RTLD_SELF, tz_change_interval_sym);
	if (tz_change_interval_p != NULL &&
	    *tz_change_interval_p > tz_change_interval) {
		debug("reducing detection interval from %d to %d",
		    *tz_change_interval_p, tz_change_interval);
		*tz_change_interval_p = tz_change_interval;
		tz_change_timeout = tz_change_interval * 3;
	}
	/* prepare chroot */
	ATF_REQUIRE_EQ(0, mkdir("root", 0755));
	ATF_REQUIRE_EQ(0, mkdir("root/etc", 0755));
	change_tz("UTC");
	time(&changed);
	/* output, error, sync pipes */
	if (pipe(opd) != 0 || pipe(epd) != 0 || pipe(spd) != 0)
		atf_tc_fail("failed to pipe");
	/* fork child */
	if ((pid = fork()) < 0)
		atf_tc_fail("failed to fork");
	if (pid == 0) {
		/* child */
		dup2(opd[1], STDOUT_FILENO);
		close(opd[0]);
		close(opd[1]);
		dup2(epd[1], STDERR_FILENO);
		close(epd[0]);
		close(epd[1]);
		close(spd[0]);
		unsetenv("TZ");
		ATF_REQUIRE_EQ(0, chroot("root"));
		ATF_REQUIRE_EQ(0, chdir("/"));
		fds[0].fd = spd[1];
		fds[0].events = POLLIN;
		for (;;) {
			ATF_REQUIRE(poll(fds, 1, 100) >= 0);
			if (fds[0].revents & POLLHUP) {
				/* parent closed sync pipe */
				_exit(0);
			}
			ATF_REQUIRE((tm = localtime(&then)) != NULL);
			if (tm->tm_gmtoff == curoff)
				continue;
			olen = strftime(obuf, sizeof(obuf), "%z (%Z)", tm);
			ATF_REQUIRE(olen > 0);
			fprintf(stdout, "%s\n", obuf);
			fflush(stdout);
			curoff = tm->tm_gmtoff;
		}
		_exit(2);
	}
	/* parent */
	close(opd[1]);
	close(epd[1]);
	close(spd[1]);
	/* receive output until child terminates */
	fds[0].fd = opd[0];
	fds[0].events = POLLIN;
	fds[1].fd = epd[0];
	fds[1].events = POLLIN;
	fds[2].fd = spd[0];
	fds[2].events = POLLIN;
	nfds = 3;
	for (;;) {
		ATF_REQUIRE(poll(fds, 3, 1000) >= 0);
		time(&now);
		if (fds[0].revents & POLLIN && olen < sizeof(obuf)) {
			rlen = read(opd[0], obuf + olen, sizeof(obuf) - olen);
			ATF_REQUIRE(rlen >= 0);
			olen += rlen;
		}
		if (olen > 0) {
			ATF_REQUIRE_EQ('\n', obuf[olen - 1]);
			obuf[--olen] = '\0';
			/* tzcase will be NULL at first */
			if (tzcase != NULL) {
				debug("%s", obuf);
				ATF_REQUIRE_STREQ(tzcase->expect, obuf);
				debug("change to %s detected after %d s",
				    tzcase->tzfn, (int)(now - changed));
				if (tz_change_interval_p != NULL) {
					ATF_CHECK((int)(now - changed) >=
					    *tz_change_interval_p - 1);
					ATF_CHECK((int)(now - changed) <=
					    *tz_change_interval_p + 1);
				}
			}
			olen = 0;
			/* first / next test case */
			if (tzcase == NULL)
				tzcase = tzcases;
			else
				tzcase++;
			if (tzcase->tzfn == NULL) {
				/* test is over */
				break;
			}
			change_tz(tzcase->tzfn);
			changed = now;
		}
		if (fds[1].revents & POLLIN && elen < sizeof(ebuf)) {
			rlen = read(epd[0], ebuf + elen, sizeof(ebuf) - elen);
			ATF_REQUIRE(rlen >= 0);
			elen += rlen;
		}
		if (elen > 0) {
			ATF_REQUIRE_EQ(elen, fwrite(ebuf, 1, elen, stderr));
			elen = 0;
		}
		if (nfds > 2 && fds[2].revents & POLLHUP) {
			/* child closed sync pipe */
			break;
		}
		/*
		 * The timeout for this test case is set to 10 minutes,
		 * because it can take that long to run with the default
		 * 61-second interval.  However, each individual tzcase
		 * entry should not take much longer than the detection
		 * interval to test, so we can detect a problem long
		 * before Kyua terminates us.
		 */
		if ((now - changed) > tz_change_timeout) {
			close(spd[0]);
			if (tz_change_interval_p == NULL &&
			    tzcase == tzcases) {
				/*
				 * The most likely explanation in this
				 * case is that libc was built without
				 * time zone change detection.
				 */
				atf_tc_skip("time zone change detection "
				    "does not appear to be enabled");
			}
			atf_tc_fail("timed out waiting for change to %s "
			    "to be detected", tzcase->tzfn);
		}
	}
	close(opd[0]);
	close(epd[0]);
	close(spd[0]); /* this will wake up and terminate the child */
	if (olen > 0)
		ATF_REQUIRE_EQ(olen, fwrite(obuf, 1, olen, stdout));
	if (elen > 0)
		ATF_REQUIRE_EQ(elen, fwrite(ebuf, 1, elen, stderr));
	ATF_REQUIRE_EQ(pid, waitpid(pid, &status, 0));
	ATF_REQUIRE(WIFEXITED(status));
	ATF_REQUIRE_EQ(0, WEXITSTATUS(status));
}
#endif /* DETECT_TZ_CHANGES */

static void
test_tz_env(const char *tzval, const char *expect)
{
	setenv("TZ", tzval, 1);
	test_tz(expect);
}

static void
tz_env_common(void)
{
	char path[MAXPATHLEN];
	const struct tzcase *tzcase = tzcases;
	int len;

	/* relative path */
	for (tzcase = tzcases; tzcase->tzfn != NULL; tzcase++)
		test_tz_env(tzcase->tzfn, tzcase->expect);
	/* absolute path */
	for (tzcase = tzcases; tzcase->tzfn != NULL; tzcase++) {
		len = snprintf(path, sizeof(path), "%s/%s", TZDIR, tzcase->tzfn);
		ATF_REQUIRE(len > 0 && (size_t)len < sizeof(path));
		test_tz_env(path, tzcase->expect);
	}
	/* absolute path with additional slashes */
	for (tzcase = tzcases; tzcase->tzfn != NULL; tzcase++) {
		len = snprintf(path, sizeof(path), "%s/////%s", TZDIR, tzcase->tzfn);
		ATF_REQUIRE(len > 0 && (size_t)len < sizeof(path));
		test_tz_env(path, tzcase->expect);
	}
}

ATF_TC(tz_env);
ATF_TC_HEAD(tz_env, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test TZ environment variable");
}
ATF_TC_BODY(tz_env, tc)
{
	tz_env_common();
	/* escape from TZDIR is permitted when not setugid */
	test_tz_env("../zoneinfo/UTC", utc.expect);
}


ATF_TC(tz_invalid_env);
ATF_TC_HEAD(tz_invalid_env, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test invalid TZ value");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(tz_invalid_env, tc)
{
	test_tz_env("invalid", invalid.expect);
	test_tz_env(":invalid", invalid.expect);
}

ATF_TC(setugid);
ATF_TC_HEAD(setugid, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test setugid process");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(setugid, tc)
{
	const struct tzcase *tzcase = tzcases;

	/* prepare chroot */
	ATF_REQUIRE_EQ(0, mkdir("root", 0755));
	ATF_REQUIRE_EQ(0, mkdir("root/etc", 0755));
	change_tz(tzcase->tzfn);
	/* enter chroot */
	ATF_REQUIRE_EQ(0, chroot("root"));
	ATF_REQUIRE_EQ(0, chdir("/"));
	/* become setugid */
	ATF_REQUIRE_EQ(0, seteuid(UID_NOBODY));
	ATF_REQUIRE(issetugid());
	/* check timezone */
	unsetenv("TZ");
	test_tz(tzcases->expect);
}

ATF_TC(tz_env_setugid);
ATF_TC_HEAD(tz_env_setugid, tc)
{
	atf_tc_set_md_var(tc, "descr", "Test TZ environment variable "
		"in setugid process");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(tz_env_setugid, tc)
{
	ATF_REQUIRE_EQ(0, seteuid(UID_NOBODY));
	ATF_REQUIRE(issetugid());
	tz_env_common();
	/* escape from TZDIR is not permitted when setugid */
	test_tz_env("../zoneinfo/UTC", invalid.expect);
}

ATF_TP_ADD_TCS(tp)
{
	debugging = !getenv("__RUNNING_INSIDE_ATF_RUN") &&
	    isatty(STDERR_FILENO);
	ATF_TP_ADD_TC(tp, tz_default);
	ATF_TP_ADD_TC(tp, tz_invalid_file);
	ATF_TP_ADD_TC(tp, thin_jail);
#ifdef DETECT_TZ_CHANGES
	ATF_TP_ADD_TC(tp, detect_tz_changes);
#endif /* DETECT_TZ_CHANGES */
	ATF_TP_ADD_TC(tp, tz_env);
	ATF_TP_ADD_TC(tp, tz_invalid_env);
	ATF_TP_ADD_TC(tp, setugid);
	ATF_TP_ADD_TC(tp, tz_env_setugid);
	return (atf_no_error());
}