/*
 * vim: tabstop=2 shiftwidth=2 softtabstop=2 expandtab:
 *
 * curcfg_tool - Utility to alter curcfg.xml on Huawei B593 u-12
 *
 * This code is derived from software contributed to Berkeley by
 *
 * Copyright (c) 2014 Jari Turkia <jatu@hqcodeshop.fi>
 * Licensed under GPLv2, see file gpl-2.0.txt.
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>

#define VERSION "0.3"
#define CONFIG_BUFFER_SIZE 65536

enum {
  CHANGE_GUI = 1,
  CHANGE_SSH = 2,
  IPTABLES = 4,
  RC_LOCAL = 8,
  NTP = 16
} options;

/**
 *
 */
void usage(const char* errorText)
{
  if (errorText) {
    printf(errorText);
  }
  printf(
"Usage:\n"
"-V                     - Print version information\n"
"-cw <base64 encoded web gui password>  - set password\n"
"-cs <base64 encoded SSH password>      - set password\n"
"-rc <script path and filename>         - rc.local: run a script on boot\n"
"-ntp[1-5] <NTP-server address>         - set NTP-server, 5 of them\n"
"-w                     - write changes to flash (default: don't write)\n"
"-fi <file name>        - input file (default: read from flash)\n"
"-fo <file name>        - write changes (default: /tmp/flashinfo.bin)\n"
  );
}

/**
 * Get the configuration size
 */
int configSize(const char* flashInfoFile)
{
  int fd;
  int bytes;
  unsigned char config[4];
  unsigned int configSize;
  fd = open(flashInfoFile, O_RDONLY);
  if (!fd) {
    fprintf(stderr, "Failed to open file '%s'!\n", flashInfoFile);
    return -1;
  }
  bytes = read(fd, config, 4);
  close(fd);
  if (bytes != 4) {
    fprintf(stderr, "Failed to read file '%s'!\n", flashInfoFile);
    return -1;
  }
  if (config[0] != 0x3E) {
    fprintf(stderr, "Does not contain correct memory segment! '%s'!\n", flashInfoFile);
    return -1;
  }
  configSize = (config[1] << 16) + (config[2] << 8) + config[3];

  return configSize;
}

/**
 * Read the XML-config
 */
int readConfig(const char* flashInfoFile, int configSize, unsigned char* config)
{
  int fd;
  int bytes;
  fd = open(flashInfoFile, O_RDONLY);
  if (!fd) {
    fprintf(stderr, "Failed to open file '%s'! %s\n", flashInfoFile, strerror(errno));
    return -1;
  }
  bytes = read(fd, config, configSize + 4);
  close(fd);
  if (bytes != configSize + 4) {
    fprintf(stderr, "Failed to read file '%s'! %s\n", flashInfoFile, strerror(errno));
    return -1;
  }
  if (config[0] != 0x3E) {
    fprintf(stderr, "Does not contain correct memory segment! '%s'!\n", flashInfoFile);
    return -1;
  }
  /* Remove the header from buffer */
  memmove(config, config + 4, configSize);

  return bytes;
}

/**
 * Write the XML-config
 */
int writeConfig(const char* flashInfoFile, int configSize, unsigned char* config)
{
  int fd;
  int bytes;
  unsigned char buffer[4];
  fd = open(flashInfoFile, O_WRONLY | O_CREAT | O_TRUNC, 0777);
  if (!fd) {
    fprintf(stderr, "Failed to open file '%s'! %s\n", flashInfoFile, strerror(errno));
    return -1;
  }
  buffer[0] = 0x3E;
  buffer[1] = configSize >> 16 & 0xff;
  buffer[2] = configSize >> 8 & 0xff;
  buffer[3] = configSize & 0xff;
  bytes = write(fd, buffer, 4);
  if (bytes != 4) {
    fprintf(stderr, "Failed to write file '%s'! %s\n", flashInfoFile, strerror(errno));
    return -1;
  }
  bytes = write(fd, config, configSize + 1);
  if (bytes != configSize + 1) {
    fprintf(stderr, "Failed to write file '%s'! %s\n", flashInfoFile, strerror(errno));
    return -1;
  }
  close(fd);

  return bytes;
}

/**
 * Change password for user
 * Either GUI or SSH
 */
void ChangePassword(unsigned int* configSizeOut,
                  const char* config, const char* configEnd,
                  const char* user, const char* password,
                  int updateIsChanged)
{
  unsigned int configSizeIn = *configSizeOut;
  char* userInfoPos = NULL;
  char* xmlPos = NULL;
  char userAttr[256];
  int userAttrLen = 0;
  int changedOk = 0;

  if (strlen(user) > 16) {
    fprintf(stderr, "Username cannot be that long!\n");
    exit(1);
  }
  strcpy(userAttr, "Username=\"");
  strcat(userAttr, user);
  strcat(userAttr, "\"");
  userAttrLen = strlen(userAttr);

  const char* configStart = config;
  do {
    userInfoPos = strstr(configStart, "<UserInfoInstance");
    if (userInfoPos == NULL || userInfoPos >= configEnd) {
      /* Didn't find the user at all! We _could_ insert it, but ... */
      fprintf(stderr, "Not sane curcfg.xml! Doesn't contain '%s' user to be changed.\n", user);
      exit(1);
    }
    /* Look for username */
    xmlPos = userInfoPos;
    int found;
    found = 0;
    while (*xmlPos && *xmlPos != '>') {
      if (strncmp(xmlPos, userAttr, userAttrLen) == 0) {
        found = 1;
        break;
      }
      ++xmlPos;
    }
    if (!found) {
      /* Try next user */
      configStart = xmlPos;
      continue;
    }
    /* Look for password */
    found = 0;
    while (*xmlPos && *xmlPos != '>') {
      if (strncmp(xmlPos, "Userpassword=\"", 14) == 0) {
        found = 1;
        break;
      }
      ++xmlPos;
    }
    if (!found) {
      /* Try next user */
      configStart = xmlPos;
      continue;
    }

    /* Look for isChanged="0" */
    if (updateIsChanged) {
      char* isChangedPos = userInfoPos;
      found = 0;
      while (*isChangedPos && *isChangedPos != '>') {
        if (strncmp(isChangedPos, "IsChanged=\"", 11) == 0) {
          found = 1;
          break;
        }
        ++isChangedPos;
      }
      if (!found) {
        /* Ok. Now this is officially weird:
         * We have everything else, except the IsChanged=""
         * Try next user
         */
        configStart = isChangedPos;
        continue;
      }
      isChangedPos += 11;
      *isChangedPos = '1';
    }

    /* Change the password */
    xmlPos += 14;
    const char* quotePos = xmlPos;
    while (*quotePos && *quotePos != '>' && *quotePos != '"') {
      ++quotePos;
    }
    if (*quotePos != '"') {
      fprintf(stderr, "Not sane curcfg.xml! Password does not have a quote in it.\n");
      exit(1);
    }
    int newLen = strlen(password);
    int oldLen = quotePos - xmlPos;
    int maxLen = CONFIG_BUFFER_SIZE - configSizeIn;
    if (newLen > maxLen) {
      fprintf(stderr, "Not enough room for new passwod. Too long!\n");
      exit(1);
    }
    memmove(xmlPos + newLen, quotePos, configSizeIn - (quotePos - (const char*)config));
    strncpy(xmlPos, password, newLen);
    *configSizeOut += newLen - oldLen;
    changedOk = 1;
    break;
  } while (xmlPos < configEnd && !changedOk);
  if (!changedOk) {
    printf("Could not alter the configuration! Stopping.\n");
    exit(1);
  }
}

/**
 * Change automatic firmware upgrade URL
 * The URL can contain ; <command to run>
 * ... and it will be run on boot! Nice! :-)
 */
void ChangeUpdateURL(unsigned int* configSizeOut,
                  const char* config, const char* configEnd,
                  const char* updateURL)
{
  unsigned int configSizeIn = *configSizeOut;
  char* httpUpgPos = NULL;
  char* xmlPos = NULL;
  int updateURLLen = strlen(updateURL);
  int changedOk = 0;

  if (updateURLLen <= 0) {
    fprintf(stderr, "Really!? Should you give an URL?\n");
    exit(1);
  }
  if (strchr(updateURL, '"') != NULL) {
    fprintf(stderr, "The URL needs to be XML-formatted. No weird characters!\n");
    exit(1);
  }

  const char* configStart = config;
  do {
    httpUpgPos = strstr(configStart, "<HttpUpg");
    if (httpUpgPos == NULL || httpUpgPos >= configEnd) {
      /* Didn't find the user at all! We _could_ insert it, but ... */
      fprintf(stderr, "Not sane curcfg.xml! Doesn't contain <HttpUpg /> URL to be changed.\n");
      exit(1);
    }

    int found = 0;
    xmlPos = httpUpgPos;
    while (*xmlPos && *xmlPos != '>') {
      if (strncmp(xmlPos, "UpdateURL=\"", 11) == 0) {
        found = 1;
        break;
      }
      ++xmlPos;
    }

    if (!found) {
      /* Ok. Now this is officially weird:
       * We have everything else, except the UpdateURL=""
       */
      fprintf(stderr, "Not sane curcfg.xml! Doesn't contain <HttpUpg UpdateURL="" /> URL to be changed.\n");
      exit(1);
    }

    /* Change the URL */
    xmlPos += 11;
    const char* quotePos = xmlPos;
    while (*quotePos && *quotePos != '>' && *quotePos != '"') {
      ++quotePos;
    }
    if (*quotePos != '"') {
      fprintf(stderr, "Not sane curcfg.xml! URL does not have a quote in it.\n");
      exit(1);
    }
    int newLen = updateURLLen;
    int oldLen = quotePos - xmlPos;
    int maxLen = CONFIG_BUFFER_SIZE - configSizeIn;
    if (newLen > maxLen) {
      fprintf(stderr, "Not enough room for new URL. Too long!\n");
      exit(1);
    }
    memmove(xmlPos + newLen, quotePos, configSizeIn - (quotePos - (const char*)config));
    strncpy(xmlPos, updateURL, newLen);
    *configSizeOut += newLen - oldLen;
    changedOk = 1;
    break;
  } while (xmlPos < configEnd && !changedOk);
  if (!changedOk) {
    printf("Could not alter the configuration! Stopping.\n");
    exit(1);
  }
}

/**
 * Change NTP-server
 * These are hard-coded by telco and cannot be changed
 */
void ChangeNTP(unsigned int* configSizeOut,
                  const char* config, const char* configEnd,
                  char serverNumber, const char* ntpServer)
{
  unsigned int configSizeIn = *configSizeOut;
  char* timePos = NULL;
  char* xmlPos = NULL;
  char serverAttr[16];
  int ntpServerLen = strlen(ntpServer);   /* Can be 0 */
  int changedOk = 0;

  if (strchr(ntpServer, '"') != NULL) {
    fprintf(stderr, "The URL needs to be XML-formatted. No weird characters!\n");
    exit(1);
  }
  sprintf(serverAttr, "NTPServer%c=\"", serverNumber);

  const char* configStart = config;
  do {
    timePos = strstr(configStart, "<Time");
    if (timePos == NULL || timePos >= configEnd) {
      /* Didn't find the user at all! We _could_ insert it, but ... */
      fprintf(stderr, "Not sane curcfg.xml! Doesn't contain <Time /> settings to be changed.\n");
      exit(1);
    }

    int found = 0;
    xmlPos = timePos;
    while (*xmlPos && *xmlPos != '>') {
      if (strncmp(xmlPos, serverAttr, 12) == 0) {
        found = 1;
        break;
      }
      ++xmlPos;
    }

    if (!found) {
      /* Ok. Now this is officially weird:
       * We have everything else, except the NTPServer1=""
       */
      fprintf(stderr, "Not sane curcfg.xml! Doesn't contain <Time NTPServer="" /> URL to be changed.\n");
      exit(1);
    }

    /* Change the URL */
    xmlPos += 12;
    const char* quotePos = xmlPos;
    while (*quotePos && *quotePos != '>' && *quotePos != '"') {
      ++quotePos;
    }
    if (*quotePos != '"') {
      fprintf(stderr, "Not sane curcfg.xml! URL does not have a quote in it.\n");
      exit(1);
    }
    int newLen = ntpServerLen;
    int oldLen = quotePos - xmlPos;
    int maxLen = CONFIG_BUFFER_SIZE - configSizeIn;
    if (newLen > maxLen) {
      fprintf(stderr, "Not enough room for new URL. Too long!\n");
      exit(1);
    }
    memmove(xmlPos + newLen, quotePos, configSizeIn - (quotePos - (const char*)config));
    strncpy(xmlPos, ntpServer, newLen);
    *configSizeOut += newLen - oldLen;
    changedOk = 1;
    break;
  } while (xmlPos < configEnd && !changedOk);
  if (!changedOk) {
    printf("Could not alter the configuration! Stopping.\n");
    exit(1);
  }
}

/**
 * Main
 */
int main(int argc, char *argv[])
{
  if (argc < 2) {
    usage(NULL);
    return 0;
  }

  /* Parse parameters, plan what to do */
  int argIdx, optIdx;
  unsigned char operations = 0;
  char optWrite = 0;
  char error[512];
  const char* const opts[] = {"-cw", "-w", "-h", "-fi", "-fo", "-V", "-cs",
                              "-rc", "-ntp1", "-ntp2", "-ntp3", "-ntp4",
                              "-ntp5", NULL};
  char* optArgs[sizeof(opts) / sizeof(opts[0])];

  for (optIdx = 0; opts[optIdx]; ++optIdx) {
    optArgs[optIdx] = NULL;
  }
  for (argIdx = 1; argIdx < argc; ++argIdx) {
    int foundOpt = -1;
    for (optIdx = 0; opts[optIdx]; ++optIdx) {
      if (strcmp(argv[argIdx], opts[optIdx]) == 0) {
        foundOpt = optIdx;
        break;
      }
    }
    switch (foundOpt) {
    case 0:	/* -cw */
      if (++argIdx == argc) {
        sprintf(error, "Need the Base64-password when using '%s'\n", argv[argIdx]);
        usage(error);
        return 1;
      }
      operations |= CHANGE_GUI;
      optArgs[foundOpt] = argv[argIdx];
      break;

    case 1:	/* -w */
      /* Write changes back to flash */
      optWrite = 1;
      break;

    case 2:	/* -h */
      usage(NULL);
      return 0;

    case 3:	/* -fi */
      if (++argIdx == argc) {
        sprintf(error, "Need the filename when using '%s'\n", argv[argIdx]);
        usage(error);
        return 1;
      }
      optArgs[foundOpt] = argv[argIdx];
      break;

    case 4:	/* -fo */
      if (++argIdx == argc) {
        sprintf(error, "Need the filename when using '%s'\n", argv[argIdx]);
        usage(error);
        return 1;
      }
      optArgs[foundOpt] = argv[argIdx];
      break;

    case 5:	/* -V */
      printf("Version: %s Build: %s\n", VERSION, __DATE__);
      return 0;

    case 6:	/* -cs */
      if (++argIdx == argc) {
        sprintf(error, "Need the Base64-password when using '%s'\n", argv[argIdx]);
        usage(error);
        return 1;
      }
      operations |= CHANGE_SSH;
      optArgs[foundOpt] = argv[argIdx];
      break;

    case 7:	/* -rc */
      if (++argIdx == argc) {
        sprintf(error, "Need the rc.local script name when using '%s'\n", argv[argIdx]);
        usage(error);
        return 1;
      }
      operations |= RC_LOCAL;
      optArgs[foundOpt] = argv[argIdx];
      break;

    case 8:	 /* -ntp1 */
    case 9:	 /* -ntp2 */
    case 10: /* -ntp3 */
    case 11: /* -ntp4 */
    case 12: /* -ntp5 */
      if (++argIdx == argc) {
        sprintf(error, "Need the NTP server name when using '%s'\n", argv[argIdx]);
        usage(error);
        return 1;
      }
      operations |= NTP;
      optArgs[foundOpt] = argv[argIdx];
      break;

    default:
      sprintf(error, "Unknown switch '%s'\n", argv[argIdx]);
      usage(error);
      return 1;
    }
  }

  if (operations == 0) {
      sprintf(error, "Nothing to do!\n");
      usage(error);
      return 1;
  }

  /* Execute:
   * Step 1:
   * Get the size of the configuration
   */
  int stat;
  int configFromFlash = 1;
  int configToFlash = 1;
  unsigned char config[CONFIG_BUFFER_SIZE];
  unsigned int configSizeIn;
  unsigned int configSizeOut;
  int bytes;
  char* flashInfoFile = "/tmp/flashinfo.bin";
  if (optArgs[3] == NULL) {
    stat = system("flashtest export 0xE00000 4");
    if (stat != 3072) { /* 12 from /bin/sh prompt */
      fprintf(stderr, "Could not export flash configuration to get configuration length! (%d)\n", stat);
      exit(stat);
    }
  } else {
  configFromFlash = 0;
    flashInfoFile = optArgs[3]; /* -fi */
  }
  configSizeIn = configSize(flashInfoFile);
  if (configSizeIn == -1) {
    exit(1);
  }
  if (configSizeIn > sizeof(config) - 5) {
    fprintf(stderr, "Config size of %d is too big for buffer!\n", configSizeIn);
    exit(1);
  }

  /* Step 2:
   * Get the configuration
   */
  printf("Reading %d bytes of config\n", configSizeIn);
  if (configFromFlash) {
    sprintf((char*)config, "flashtest export 0xE00000 %d", configSizeIn + 4);
    stat = system((const char*)config);
    if (stat != 3072) {
      fprintf(stderr, "Could not export flash configuration! (%d)\n", stat);
      exit(stat);
    }
  }
  bytes = readConfig(flashInfoFile, configSizeIn, config);
  if (bytes == -1) {
    exit(1);
  }
  memset(config + configSizeIn, 0, sizeof(config) - configSizeIn);

  /* Step 3:
   * Alter the configuration
   */
  configSizeOut = configSizeIn;
  if (operations & CHANGE_GUI) {
    const char* webPos = strstr((const char*)config, "<X_Web");
    const char* cliPos = strstr((const char*)config, "<X_Cli>");
    if (webPos == NULL || cliPos == NULL || webPos > cliPos) {
      fprintf(stderr, "Not sane curcfg.xml! Cannot continue.\n");
      exit(1);
    }

    ChangePassword(&configSizeOut,
                  webPos, cliPos,
                  "admin", optArgs[0],
                  1);
  }
  if (operations & CHANGE_SSH) {
    const char* cliPos = strstr((const char*)config, "<X_Cli>");
    const char* endPos = strstr((const char*)config, "</UserInterface>");
    if (cliPos == NULL || endPos == NULL || cliPos > endPos) {
      fprintf(stderr, "Not sane curcfg.xml! Cannot continue.\n");
      exit(1);
    }

    ChangePassword(&configSizeOut,
                  cliPos, endPos,
                  "admin", optArgs[6],
                  0);
  }
  if (operations & RC_LOCAL) {
    /*
     * <HttpUpg
     *  UpdateURL="update-westerneurope.huaweidevice.com"
     *  UpdatePort="80"
     *  CheckNewVer="/westerneurope"/>
     */
    const char* webPos = strstr((const char*)config, "<X_Web");
    const char* cliPos = strstr((const char*)config, "<X_Cli>");
    if (webPos == NULL || cliPos == NULL || webPos > cliPos) {
      fprintf(stderr, "Not sane curcfg.xml! Cannot continue.\n");
      exit(1);
    }

    ChangeUpdateURL(&configSizeOut,
                  webPos, cliPos,
                  optArgs[7]);
  }
  if (operations & NTP) {
    /*
     * <Time Enable="1"
     *   NTPServer1="clock.fmt.he.net"
     *   NTPServer2="time.nist.gov"
     *   NTPServer3="" NTPServer4="" NTPServer5=""
     *   LocalTimeZoneName="GMT-02:00DST-03:00:00,M3.5.0/03:00:00,M10.5.0/04:00:00"
     *   X_Label="36" ConfigType="2" MannualTime="091520092014.39"
     *   DaylightSavingEnable="1"/>
     */
    const char* timePos = strstr((const char*)config, "<Time ");
    const char* notifyPos = strstr((const char*)config, "<X_notify ");
    if (timePos == NULL || notifyPos == NULL || timePos > notifyPos) {
      fprintf(stderr, "Not sane curcfg.xml! Cannot continue.\n");
      exit(1);
    }

    int idx;
    for (idx = 1; idx <= 5; ++idx) {
      if (optArgs[7 + idx] != NULL) {
        ChangeNTP(&configSizeOut,
                      timePos, notifyPos,
                      '0' + idx, optArgs[7 + idx]);
      }
    }
  }

  /* Step 4: (optional)
   * Save the configuration
   */
  memset(config + configSizeOut, 0, sizeof(config) - configSizeOut);
  char* flashInfoOutFile = "/tmp/flashinfo.bin";
  if (optArgs[4] != NULL) {
    configToFlash = 0;
    optWrite = 0;
    flashInfoOutFile = optArgs[4]; /* -fo */
  }
  printf("Writing %d bytes of config\n", configSizeOut);
  bytes = writeConfig(flashInfoOutFile, configSizeOut, config);
  if (bytes == -1) {
    exit(1);
  }
  if (optWrite && configToFlash) {
    stat = system("flashtest load /tmp/flashinfo.bin 0xE00000");
    if (stat != 4096) { /* 16 from /bin/sh prompt */
      fprintf(stderr, "Could not write flash configuration! (%d)\n", stat);
      exit(stat);
    }
  }

  return 0;
}