/* vi: set sw=4 ts=4: */
/*
 * micro lpd
 *
 * Copyright (C) 2008 by Vladimir Dronnikov <dronnikov@gmail.com>
 *
 * Licensed under GPLv2, see file LICENSE in this tarball for details.
 */

/*
 * A typical usage of BB lpd looks as follows:
 * # tcpsvd -E 0 515 lpd [SPOOLDIR] [HELPER-PROG [ARGS...]]
 *
 * This starts TCP listener on port 515 (default for LP protocol).
 * When a client connection is made (via lpr) lpd first changes its
 * working directory to SPOOLDIR (current dir is the default).
 *
 * SPOOLDIR is the spool directory which contains printing queues
 * and should have the following structure:
 *
 * SPOOLDIR/
 *      <queue1>
 *      ...
 *      <queueN>
 *
 * <queueX> can be of two types:
 *      A. a printer character device, an ordinary file or a link to such;
 *      B. a directory.
 *
 * In case A lpd just dumps the data it receives from client (lpr) to the
 * end of queue file/device. This is non-spooling mode.
 *
 * In case B lpd enters spooling mode. It reliably saves client data along
 * with control info in two unique files under the queue directory. These
 * files are named dfAXXXHHHH and cfAXXXHHHH, where XXX is the job number
 * and HHHH is the client hostname. Unless a printing helper application
 * is specified lpd is done at this point.
 *
 * NB: file names are produced by peer! They actually may be anything at all.
 * lpd only sanitizes them (by removing most non-alphanumerics).
 *
 * If HELPER-PROG (with optional arguments) is specified then lpd continues
 * to process client data:
 *      1. it reads and parses control file (cfA...). The parse process
 *      results in setting environment variables whose values were passed
 *      in control file; when parsing is complete, lpd deletes control file.
 *      2. it spawns specified helper application. It is then
 *      the helper application who is responsible for both actual printing
 *      and deleting of processed data file.
 *
 * A good lpr passes control files which when parsed provides the following
 * variables:
 * $H = host which issues the job
 * $P = user who prints
 * $C = class of printing (what is printed on banner page)
 * $J = the name of the job
 * $L = print banner page
 * $M = the user to whom a mail should be sent if a problem occurs
 *
 * We specifically filter out and NOT provide:
 * $l = name of datafile ("dfAxxx") - file whose content are to be printed
 *
 * lpd provides $DATAFILE instead - the ACTUAL name
 * of the datafile under which it was saved.
 * $l would be not reliable (you would be at mercy of remote peer).
 *
 * Thus, a typical helper can be something like this:
 * #!/bin/sh
 * cat ./"$DATAFILE" >/dev/lp0
 * mv -f ./"$DATAFILE" save/
 */

#include "libbb.h"

// strip argument of bad chars
static char *sane(char *str)
{
        char *s = str;
        char *p = s;
        while (*s) {
                if (isalnum(*s) || '-' == *s || '_' == *s) {
                        *p++ = *s;
                }
                s++;
        }
        *p = '\0';
        return str;
}

static char *xmalloc_read_stdin(void)
{
        // SECURITY:
        size_t max = 4 * 1024; // more than enough for commands!
        return xmalloc_reads(STDIN_FILENO, NULL, &max);
}

int lpd_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE;
int lpd_main(int argc UNUSED_PARAM, char *argv[])
{
        int spooling = spooling; // for compiler
        char *s, *queue;
        char *filenames[2];

        // goto spool directory
        if (*++argv)
                xchdir(*argv++);

        // error messages of xfuncs will be sent over network
        xdup2(STDOUT_FILENO, STDERR_FILENO);

        // nullify ctrl/data filenames
        memset(filenames, 0, sizeof(filenames));

        // read command
        s = queue = xmalloc_read_stdin();
        // we understand only "receive job" command
        if (2 != *queue) {
 unsupported_cmd:
                printf("Command %02x %s\n",
                        (unsigned char)s[0], "is not supported");
                goto err_exit;
        }

        // parse command: "2 | QUEUE_NAME | '\n'"
        queue++;
        // protect against "/../" attacks
        // *strchrnul(queue, '\n') = '\0'; - redundant, sane() will do
        if (!*sane(queue))
                return EXIT_FAILURE;

        // queue is a directory -> chdir to it and enter spooling mode
        spooling = chdir(queue) + 1; // 0: cannot chdir, 1: done
        // we don't free(s), we might need "queue" var later

        while (1) {
                char *fname;
                int fd;
                // int is easier than ssize_t: can use xatoi_u,
                // and can correctly display error returns (-1)
                int expected_len, real_len;

                // signal OK
                safe_write(STDOUT_FILENO, "", 1);

                // get subcommand
                // valid s must be of form: "SUBCMD | LEN | space | FNAME"
                // N.B. we bail out on any error
                s = xmalloc_read_stdin();
                if (!s) { // (probably) EOF
                        char *p, *q, var[2];

                        // non-spooling mode or no spool helper specified
                        if (!spooling || !*argv)
                                return EXIT_SUCCESS; // the only non-error exit
                        // spooling mode but we didn't see both ctrlfile & datafile
                        if (spooling != 7)
                                goto err_exit; // reject job

                        // spooling mode and spool helper specified -> exec spool helper
                        // (we exit 127 if helper cannot be executed)
                        var[1] = '\0';
                        // read and delete ctrlfile
                        q = xmalloc_xopen_read_close(filenames[0], NULL);
                        unlink(filenames[0]);
                        // provide datafile name
                        // we can use leaky setenv since we are about to exec or exit
                        xsetenv("DATAFILE", filenames[1]);
                        // parse control file by "\n"
                        while ((p = strchr(q, '\n')) != NULL && isalpha(*q)) {
                                *p++ = '\0';
                                // q is a line of <SYM><VALUE>,
                                // we are setting environment string <SYM>=<VALUE>.
                                // Ignoring "l<datafile>", exporting others:
                                if (*q != 'l') {
                                        var[0] = *q++;
                                        xsetenv(var, q);
                                }
                                q = p; // next line
                        }
                        // helper should not talk over network.
                        // this call reopens stdio fds to "/dev/null"
                        // (no daemonization is done)
                        bb_daemonize_or_rexec(DAEMON_DEVNULL_STDIO | DAEMON_ONLY_SANITIZE, NULL);
                        BB_EXECVP(*argv, argv);
                        exit(127);
                }

                // validate input.
                // we understand only "control file" or "data file" cmds
                if (2 != s[0] && 3 != s[0])
                        goto unsupported_cmd;
                if (spooling & (1 << (s[0]-1))) {
                        printf("Duplicated subcommand\n");
                        goto err_exit;
                }
                // get filename
                *strchrnul(s, '\n') = '\0';
                fname = strchr(s, ' ');
                if (!fname) {
// bad_fname:
                        printf("No or bad filename\n");
                        goto err_exit;
                }
                *fname++ = '\0';
//              // s[0]==2: ctrlfile, must start with 'c'
//              // s[0]==3: datafile, must start with 'd'
//              if (fname[0] != s[0] + ('c'-2))
//                      goto bad_fname;
                // get length
                expected_len = bb_strtou(s + 1, NULL, 10);
                if (errno || expected_len < 0) {
                        printf("Bad length\n");
                        goto err_exit;
                }
                if (2 == s[0] && expected_len > 16 * 1024) {
                        // SECURITY:
                        // ctrlfile can't be big (we want to read it back later!)
                        printf("File is too big\n");
                        goto err_exit;
                }

                // open the file
                if (spooling) {
                        // spooling mode: dump both files
                        // job in flight has mode 0200 "only writable"
                        sane(fname);
                        fd = open3_or_warn(fname, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200);
                        if (fd < 0)
                                goto err_exit;
                        filenames[s[0] - 2] = xstrdup(fname);
                } else {
                        // non-spooling mode:
                        // 2: control file (ignoring), 3: data file
                        fd = -1;
                        if (3 == s[0])
                                fd = xopen(queue, O_RDWR | O_APPEND);
                }

                // signal OK
                safe_write(STDOUT_FILENO, "", 1);

                // copy the file
                real_len = bb_copyfd_size(STDIN_FILENO, fd, expected_len);
                if (real_len != expected_len) {
                        printf("Expected %d but got %d bytes\n",
                                expected_len, real_len);
                        goto err_exit;
                }
                // get EOF indicator, see whether it is NUL (ok)
                // (and don't trash s[0]!)
                if (safe_read(STDIN_FILENO, &s[1], 1) != 1 || s[1] != 0) {
                        // don't send error msg to peer - it obviously
                        // doesn't follow the protocol, so probably
                        // it can't understand us either
                        goto err_exit;
                }

                if (spooling) {
                        // chmod completely downloaded file as "readable+writable"
                        fchmod(fd, 0600);
                        // accumulate dump state
                        // N.B. after all files are dumped spooling should be 1+2+4==7
                        spooling |= (1 << (s[0]-1)); // bit 1: ctrlfile; bit 2: datafile
                }

                free(s);
                close(fd); // NB: can do close(-1). Who cares?

                // NB: don't do "signal OK" write here, it will be done
                // at the top of the loop
        } // while (1)

 err_exit:
        // don't keep corrupted files
        if (spooling) {
#define i spooling
                for (i = 2; --i >= 0; )
                        if (filenames[i])
                                unlink(filenames[i]);
        }
        return EXIT_FAILURE;
}