#include "UnapiNet.hh"

#include "MSXException.hh"

#include "one_of.hh"

#include "serialize.hh"

#ifdef _WIN32

#include <ws2tcpip.h>

#include <iphlpapi.h>

#include <icmpapi.h>

#ifdef interface

// The Microsoft headers above define the 'interface' macro again (Socket.hh

// already undoes the one from winsock2). Undo it here too, so it cannot

// clobber openMSX code that uses the word as an identifier.

#undef interface

#endif

#else

#include <arpa/inet.h>

#include <netdb.h>

#include <netinet/tcp.h>

#include <errno.h>

#endif

#include <algorithm>

#include <cassert>

#include <chrono>

#include <cstring>

#include <expected>

// Socket handles are openMSX SOCKET values (see Socket.hh); no casts needed.

// UnapiNet - MSX-UNAPI TCP/IP bridge device

//

// Bridge between the MSX I/O ports and BSD sockets on the host, speaking

// protocol v2 (see network/protocol-v2.md): every reply begins with a

// status byte carrying an MSX-UNAPI error code verbatim, so the Z80 driver

// hands it to its caller without translating. Async DNS, TCP and UDP (4

// connections each), ICMP echo where the host supports it.

namespace openmsx {

// MSX-UNAPI TCP/IP error codes: v2 speaks them natively on the wire (the

// status byte fronting every reply), so these values are shared with the

// Z80 driver's error table.

static constexpr uint8_t ERR_OK           = 0;

static constexpr uint8_t ERR_NOT_IMP      = 1;

static constexpr uint8_t ERR_NO_NETWORK   = 2;

static constexpr uint8_t ERR_NO_DATA      = 3;

static constexpr uint8_t ERR_INV_PARAM    = 4;

static constexpr uint8_t ERR_QUERY_EXISTS = 5;

static constexpr uint8_t ERR_NO_FREE_CONN = 9;

static constexpr uint8_t ERR_NO_CONN      = 11;

static constexpr uint8_t ERR_CONN_STATE   = 12;

static constexpr uint8_t ERR_BUFFER       = 13;

// DETECT capability byte: bits 0-3 are informational and always set on this

// device; bit4 (ICMP) is honest - latched once at device start and enforced

// by the ICMP commands.

static constexpr uint8_t CAPS_BASE = 0x0F; // DNS + TCP active/passive + UDP

static constexpr uint8_t CAP_ICMP  = 0x10;

// Maximum result payload per TCP_RECV command, and the exact-size ceiling

// on a TCP_SEND length (rule 3 makes exceeding it ERR_INV_PARAM).

static constexpr size_t MAX_TRANSFER = 4096;

// Maximum receive buffer size per connection

// BBS ANSI screens can be 16-32KB, needs big buffer

static constexpr size_t MAX_RECV_BUF = 65536;

// Upper bound on accumulated command parameters: one byte MORE than the

// largest legal parameter block (UDP_SEND: 9-byte header + a full 16-bit

// payload). A block the cap truncated therefore always ends on an illegal

// size, so every command's size check rejects it - no separate overflow

// flag needed - while a runaway MSX program hammering the data port still

// cannot exhaust host memory.

static constexpr size_t MAX_PARAM_BUF = sizeof(UdpSendParamHeader) + 0xFFFF + 1;

// DNS_QUERY's own size cap (rule 3 "too long"): the DNS presentation-form

// name limit (RFC 1035). Keeps the one variable-length command that has no

// declared payload length from depending on MAX_PARAM_BUF for rejection.

static constexpr size_t MAX_HOSTNAME = 253;

// Bound on data queued for sending but not yet accepted by the kernel.

// TCP_SEND reports ERR_BUFFER rather than blocking the emulation thread.

static constexpr size_t MAX_SEND_BUF = 64 * 1024;

// Bounds on the receive-side queues (v1 values, unchanged in v2).

static constexpr size_t MAX_UDP_QUEUE  = 16;   // pending datagrams per socket

static constexpr size_t MAX_ICMP_QUEUE = 16;   // pending echo replies

static constexpr size_t MAX_UDP_DGRAM  = 2048; // larger datagrams are truncated at receive

// Bridge command opcodes (wire protocol, shared with the Z80 driver).

// 0x10 (v1's QUERY_CAP) is retired: DETECT carries the capabilities, and

// the opcode answers ERR_NOT_IMP like any other unknown one.

static constexpr uint8_t CMD_DETECT      = 0x00;

static constexpr uint8_t CMD_DNS_QUERY   = 0x01;

static constexpr uint8_t CMD_DNS_STATUS  = 0x02;

static constexpr uint8_t CMD_TCP_OPEN    = 0x03;

static constexpr uint8_t CMD_TCP_SEND    = 0x04;

static constexpr uint8_t CMD_TCP_RECV    = 0x05;

static constexpr uint8_t CMD_TCP_CLOSE   = 0x06;

static constexpr uint8_t CMD_TCP_STATE   = 0x07;

static constexpr uint8_t CMD_TCP_ABORT   = 0x08;

static constexpr uint8_t CMD_UDP_OPEN    = 0x09;

static constexpr uint8_t CMD_UDP_CLOSE   = 0x0A;

static constexpr uint8_t CMD_UDP_STATE   = 0x0B;

static constexpr uint8_t CMD_UDP_SEND    = 0x0C;

static constexpr uint8_t CMD_GET_LOCALIP = 0x0D;

static constexpr uint8_t CMD_NET_STATE   = 0x0E;

static constexpr uint8_t CMD_UDP_RECV    = 0x0F;

static constexpr uint8_t CMD_ICMP_SEND   = 0x11;

static constexpr uint8_t CMD_ICMP_RECV   = 0x12;

// How long a half-closed connection may wait for the peer to close too,

// before we drop it and free the handle.

static constexpr auto CLOSE_TIMEOUT = std::chrono::seconds(30);

// openMSX's sock_recv()/sock_send() fold 'peer closed' and 'error' into -1,

// and decide would-block from SO_ERROR - which a synchronous WSAEWOULDBLOCK

// does not set on Windows. We need the outcomes apart, so we call

// recv()/send() here and ask the platform ourselves.

enum class IoError { WouldBlock, Closed, Failed };

using IoResult = std::expected<size_t, IoError>; // success: bytes transferred

// 'try again later' rather than a broken connection.

[[nodiscard]] static bool ioWouldBlock()

{

#ifdef _WIN32

	int err = WSAGetLastError();

	return (err == WSAEWOULDBLOCK) || (err == WSAEINTR);

#else

	return (errno == EWOULDBLOCK) || (errno == EAGAIN) || (errno == EINTR);

#endif

}

[[nodiscard]] static IoResult netRecv(SOCKET sd, char* buf, size_t count)

{

	auto n = recv(sd, buf, static_cast<int>(count), 0);

	if (n > 0) return static_cast<size_t>(n);

	if (n == 0) return std::unexpected(IoError::Closed); // orderly shutdown by the peer

	return std::unexpected(ioWouldBlock() ? IoError::WouldBlock : IoError::Failed);

}

[[nodiscard]] static IoResult netSend(SOCKET sd, const uint8_t* buf, size_t count)

{

	// MSG_NOSIGNAL: writing to a connection the peer has reset raises SIGPIPE

	// otherwise, and nothing in openMSX ignores that signal - it would take

	// the whole emulator down.

#ifdef MSG_NOSIGNAL

	constexpr int SEND_FLAGS = MSG_NOSIGNAL;

#else

	constexpr int SEND_FLAGS = 0; // Windows has no SIGPIPE

#endif

	auto n = send(sd, reinterpret_cast<const char*>(buf),

	              static_cast<int>(count), SEND_FLAGS);

	if (n >= 0) return static_cast<size_t>(n);

	return std::unexpected(ioWouldBlock() ? IoError::WouldBlock : IoError::Failed);

}

// Half-close: tell the peer we are done sending (FIN).

static void shutdownSend(SOCKET sd)

{

#ifdef _WIN32

	shutdown(sd, SD_SEND);

#else

	shutdown(sd, SHUT_WR);

#endif

}

// UNAPI DNS_S sub-error reported on a failed lookup (host name does not exist)

static constexpr uint8_t DNS_ERR_NO_SUCH_HOST = 3;

// Constructor / Destructor

UnapiNet::UnapiNet(const DeviceConfig& config)

	: MSXDevice(config)

{

	paramBuf.reserve(MAX_TRANSFER + 16);

	resultBuf.reserve(MAX_TRANSFER + 16);

	reset(EmuTime::dummy()); // keep constructor and reset() in sync

	// The loopback wake pair (see the header). Two UDP sockets on

	// 127.0.0.1: if any step fails, the host's network stack is broken

	// and every socket this device would later hand out is doomed the

	// same way - so refuse to construct instead of running degraded.

	// Requiring the pair makes poke() a guaranteed wake-up and leaves

	// the socket loop a single code path, the one that gets tested.

	// (Created before the ICMP handle: if this throws, the destructor

	// never runs, so nothing needing cleanup may precede it.)

	SOCKET r = socket(AF_INET, SOCK_DGRAM, 0);

	if (r == OPENMSX_INVALID_SOCKET) {

		throw MSXException("UnapiNet: cannot create the wake socket pair");

	}

	sockaddr_in addr = sock_makeIPv4(INADDR_LOOPBACK, 0); // any free port

	::socklen_t alen = sizeof(addr);

	if (bind(r, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) != 0 ||

	    getsockname(r, reinterpret_cast<sockaddr*>(&addr), &alen) != 0) {

		sock_close(r);

		throw MSXException("UnapiNet: cannot bind the wake socket pair");

	}

	SOCKET s = socket(AF_INET, SOCK_DGRAM, 0);

	if (s == OPENMSX_INVALID_SOCKET ||

	    connect(s, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) != 0) {

		if (s != OPENMSX_INVALID_SOCKET) sock_close(s);

		sock_close(r);

		throw MSXException("UnapiNet: cannot connect the wake socket pair");

	}

	sock_setNonBlocking(r);

	sock_setNonBlocking(s);

	wakeRecv = r;

	wakeSend = s;

#ifdef _WIN32

	// Latch the ICMP capability, once: DETECT advertises bit4 only when

	// pinging can actually work, and the ICMP commands are gated on it.

	// (IcmpSendEcho needs no privileges, unlike raw sockets.)

	if (HANDLE h = IcmpCreateFile(); h != INVALID_HANDLE_VALUE) {

		icmpChannel = h;

		icmpAvailable = true;

	}

#endif

	// Start background threads

	running = true;

	sockThread = std::thread([this]() { socketLoop(); });

	dnsThread  = std::thread([this]() { dnsWorkerLoop(); });

	if (icmpAvailable) {

		icmpWorker = std::thread([this]() { icmpWorkerLoop(); });

	}

}

UnapiNet::~UnapiNet()

{

	running = false;

	poke(); // leave select() now instead of at the next timeout

	if (sockThread.joinable()) sockThread.join();

	// Wake the ICMP worker the same way as the DNS worker below (the

	// empty critical section is explained there). If it is inside

	// IcmpSendEcho() the join waits the call out (capped at 2 s).

	{

		std::scoped_lock lock(icmpMutex);

	}

	icmpCv.notify_all();

	if (icmpWorker.joinable()) icmpWorker.join();

	// Wake the DNS worker so it observes the shutdown. If it is inside

	// getaddrinfo() the join waits that call out - deliberate, so the

	// resolver cannot write into a destroyed object.

	//

	// The empty critical section is load-bearing, not a refactoring

	// leftover: it closes the lost-wakeup window. The worker evaluates its

	// wait predicate under this mutex and cv.wait() releases-and-parks

	// atomically, so taking the mutex once *after* flipping 'running'

	// guarantees the worker is either before the predicate (it will see

	// running == false) or already parked (it will get the notify below).

	// Without it, the notify could fire in the gap between the worker

	// checking 'running' and parking - and the join would wait forever.

	{

		std::scoped_lock lock(dns.mutex);

	}

	dns.cv.notify_all();

	if (dnsThread.joinable())  dnsThread.join();

	closeAllConnections();

	// The socket thread stopped without draining its queue: close what is left,

	// or we leak every fd handed over in the last select cycle.

	{

		std::scoped_lock lock(closeMutex);

		for (SOCKET sd : socksToClose) sock_close(sd);

		socksToClose.clear();

	}

	sock_close(wakeSend);

	sock_close(wakeRecv);

#ifdef _WIN32

	if (icmpChannel) IcmpCloseHandle(icmpChannel);

#endif

}

// Reset

void UnapiNet::reset(EmuTime /*time*/)

{

	// Ground state: every connection closed and freed, every buffer and

	// queue discarded, pending reply and accumulated parameters dropped,

	// and DNS idle. The ICMP capability stays as latched at device start.

	paramBuf.clear();

	resultBuf.clear();

	resultPos = 0;

	// Ask the socket thread to drop everything (it owns the sock_close()).

	// During construction the thread doesn't exist yet - but neither do any

	// sockets, so this is a no-op then.

	for (auto& c : tcp) requestClose(c, CloseReason::NeverUsed, true);

	for (auto& u : udp) requestClose(u);

	{

		std::scoped_lock lock(dns.mutex);

		dns.status = DnsStatus::Idle;

		dns.resolvedIp = 0;

		dns.request.reset(); // disowns a lookup still in flight (it only

		                     // publishes while 'request' holds its name)

		                     // and discards a queued one in the same move

	}

	{

		std::scoped_lock lock(icmpMutex);

		icmpReplies.clear();

		++icmpGeneration; // an echo still in flight must not repopulate

		                  // the queue we just cleared

		icmpPending = false; // and a queued-but-unstarted one never starts

	}

}

// Port reads

byte UnapiNet::peekIO(uint16_t /*port*/, EmuTime /*time*/) const

{

	// Only the data register (typically 0x29) is registered for reads; the

	// command port is write-only in v2, so a read there decodes to the

	// open bus without reaching us. This returns the next unread reply

	// byte. Past the end of a reply, or with no reply pending, reads 0xFF -

	// the open-bus value an absent device yields, and never a valid

	// status (rule 4): a desynchronized driver can always tell.

	if (resultPos < resultBuf.size()) {

		return resultBuf[resultPos];

	}

	return 0xFF;

}

byte UnapiNet::readIO(uint16_t port, EmuTime time)

{

	byte b = peekIO(port, time);

	// reading the data register consumes one result byte

	if (resultPos < resultBuf.size()) {

		++resultPos;

	}

	return b;

}

// Port writes

void UnapiNet::writeIO(uint16_t port, byte value, EmuTime /*time*/)

{

	if (port & 1) {

		// parameter byte (typically 0x29). Writing one while a reply is

		// pending abandons the reply (the recovery rule) - the driver never

		// has to drain a result it lost interest in.

		resultBuf.clear();

		resultPos = 0;

		if (paramBuf.size() < MAX_PARAM_BUF) {

			paramBuf.push_back(value);

		}

		// else: drop the byte. The cap is one past the largest legal

		// block, so a truncated block is already "too long" (rule 3) at

		// every command's size check - dropping loses nothing.

	} else {

		// command (typically 0x28); replaces a pending reply, if any

		processCmd(value);

	}

}

// Result helpers

void UnapiNet::setResult(std::span<const uint8_t> data)

{

	assert(!data.empty()); // v2: every reply begins with its status byte

	resultBuf.assign(data.begin(), data.end());

	resultPos = 0;

}

void UnapiNet::replyStatus(uint8_t status)

{

	setResult(std::span<const uint8_t>(&status, 1));

}

// TCP handle management

int UnapiNet::allocTcpHandle()

{

	// A closed slot holding the sticky tail of a dead connection IS free:

	// it does not count toward ERR_NO_FREE_CONN, and reuse destroys the tail

	// (cmdTcpOpen clears the buffers when it publishes).

	for (int i = 0; i < MAX_TCP; i++) {

		if (tcp[i].sock == OPENMSX_INVALID_SOCKET &&

			tcp[i].tcpState == TcpState::Closed) {

			return i;

		}

	}

	return INVALID_HANDLE;

}

// The wire handle is a byte from the MSX: 1-based, 1..4 in range. These two

// are the only places that map wire handles to the 0-based internal arrays.

UnapiNet::TcpConnection* UnapiNet::tcpForHandle(int wireHandle)

{

	return (wireHandle >= 1 && wireHandle <= MAX_TCP) ? &tcp[wireHandle - 1] : nullptr;

}

UnapiNet::UdpConnection* UnapiNet::udpForHandle(int wireHandle)

{

	return (wireHandle >= 1 && wireHandle <= MAX_UDP) ? &udp[wireHandle - 1] : nullptr;

}

// Direct close. Only safe with the socket thread stopped (destructor).

void UnapiNet::closeTcp(TcpConnection& c)

{

	std::scoped_lock lock(c.mutex);

	if (SOCKET sd = c.sock; sd != OPENMSX_INVALID_SOCKET) {

		sock_close(sd);

		c.sock = OPENMSX_INVALID_SOCKET;

	}

	c.finSent = false;

	c.tcpState   = TcpState::Closed;

	c.remoteIp   = 0;

	c.remotePort = 0;

	c.localPort  = 0;

	c.resident   = false;

	c.recvBuf.clear();

	c.sendBuf.clear();

}

void UnapiNet::closeAllConnections()

{

	for (auto& c : tcp) {

		closeTcp(c);

		c.closeReason = CloseReason::NeverUsed;

	}

	for (auto& u : udp) {

		closeUdp(u);

	}

}

// Network socket thread (background)

//

// One select() loop serves every socket: it moves incoming TCP data into

// each connection's recvBuf, flushes queued sends, detects completion of

// a non-blocking connect() and state transitions (remote close, etc.),

// receives UDP datagrams, and performs every close. It sleeps in

// select() until traffic arrives or the emulation thread pokes the wake

// socket at it.

// Wake the socket thread out of select(): one byte to the loopback

// socket it always watches (the constructor guarantees the pair

// exists). The result is deliberately dropped: a refused send can only

// mean the wake socket already holds unread pokes, so select() has a

// byte to wake on either way - the poke is a hint, never a message,

// and the loop re-derives all its work from shared state.

void UnapiNet::poke()

{

	uint8_t b = 0;

	[[maybe_unused]] auto result = netSend(wakeSend, &b, 1);

}

void UnapiNet::deferSockClose(SOCKET sd)

{

	std::scoped_lock lock(closeMutex);

	socksToClose.push_back(sd);

	poke(); // the fd is closed at the top of the loop's next pass

}

void UnapiNet::requestClose(TcpConnection& c, CloseReason reason,

                            bool clearMetadata)

{

	SOCKET sd;

	{

		std::scoped_lock lock(c.mutex);

		sd = c.sock;

		c.sock = OPENMSX_INVALID_SOCKET; // the handle is reusable right away

		c.closeReason = reason;

		c.tcpState = TcpState::Closed;

		c.finSent = false;

		c.sendBuf.clear();

		if (clearMetadata) { // reset() only: the sticky-slot rule keeps

			c.remoteIp   = 0;  // the endpoint info and the undrained tail

			c.remotePort = 0;  // readable everywhere else

			c.localPort  = 0;

			c.resident   = false;

			c.recvBuf.clear();

		}

	}

	if (sd != OPENMSX_INVALID_SOCKET) deferSockClose(sd);

}

void UnapiNet::requestClose(UdpConnection& u)

{

	// Unlike TCP there is no sticky tail: closing a UDP socket discards

	// its queued datagrams.

	SOCKET sd;

	{

		std::scoped_lock lock(u.mutex);

		sd = u.sock;

		u.sock = OPENMSX_INVALID_SOCKET;

		u.localPort = 0;

		u.resident  = false;

		u.recvQueue.clear();

	}

	if (sd != OPENMSX_INVALID_SOCKET) deferSockClose(sd);

}

// TCP_CLOSE. A listening or still-connecting socket has nothing to

// half-close, so it is simply dropped. An established one moves to

// FinWait1: the FIN goes out as soon as whatever the MSX queued has been

// sent, and the connection is dropped when the peer closes too (or when

// CLOSE_TIMEOUT passes and it never does). A second CLOSE while that is

// in progress changes nothing (idempotent).

void UnapiNet::gracefulClose(TcpConnection& c)

{

	{

		// Test and act under one lock: the socket thread may have dropped this

		// connection (peer reset) between the two, which would leave FinWait1

		// stamped on a slot that has no socket - unusable and unrecoverable.

		std::scoped_lock lock(c.mutex);

		SOCKET sd = c.sock;

		if (sd != OPENMSX_INVALID_SOCKET) {

			if (c.tcpState == TcpState::FinWait1) {

				return; // close already in progress: idempotent

			}

			if (c.tcpState == one_of(TcpState::Established, TcpState::CloseWait)) {

				c.closeReason = CloseReason::ClosedByUser;

				c.tcpState = TcpState::FinWait1;

				c.closeDeadline = std::chrono::steady_clock::now() + CLOSE_TIMEOUT;

				c.finSent = false;

				if (c.sendBuf.empty()) {

					shutdownSend(sd);

					c.finSent = true;

				}

				poke(); // the loop now tracks this close (FIN flush,

				        // peer's close, deadline)

				return;

			}

		}

	} // drop the lock: requestClose() takes it

	// Nothing to half-close (listening, still connecting, or already gone).

	requestClose(c, CloseReason::ClosedByUser);

}

void UnapiNet::socketLoop()

{

	while (running) {

		// Close whatever the emulation thread handed over. Doing it here, at the

		// top of a pass, means no select() is in flight on those fds, so their

		// numbers cannot be recycled under a thread that is still watching them.

		{

			std::vector<SOCKET> toClose;

			{

				std::scoped_lock lock(closeMutex);

				toClose.swap(socksToClose);

			}

			for (SOCKET sd : toClose) sock_close(sd);

		}

		// Wait on all active sockets at once with a single select(),

		// instead of busy-polling each socket in turn. The wake socket is

		// always in the read set, so new work from the emulation thread

		// interrupts the wait immediately; the timeout is a backstop - it

		// paces the FinWait1 deadline check.

		fd_set rfds;

		fd_set wfds;

		fd_set efds;

		FD_ZERO(&rfds);

		FD_ZERO(&wfds);

		FD_ZERO(&efds);

		// The wake socket goes into every read set (the constructor