ra8_c6link_mdl.c

Go to the documentation of this file.

 
#include "ra8_c6link_mdl.h"
 
#include <stddef.h>
#include <stdint.h>
#include <string.h>
 
#include "ra8_attributes.h"
#include "ra8_c6link_internal.h"
#include "ra8_c6link_mdl_internal.h"
#include "ra8_media_download.pb-c.h"
 
static_assert((uint32_t)k_mdl_format_loose == RA8__MDL__FORMAT__FORMAT_LOOSE);
static_assert((uint32_t)k_mdl_format_cbz == RA8__MDL__FORMAT__FORMAT_CBZ);
static_assert((uint32_t)k_mdl_format_cbt == RA8__MDL__FORMAT__FORMAT_CBT);
static_assert((uint32_t)k_mdl_format_cbr == RA8__MDL__FORMAT__FORMAT_CBR);
static_assert((uint32_t)k_mdl_format_cbt_xz == RA8__MDL__FORMAT__FORMAT_CBT_XZ);
static_assert((uint32_t)k_mdl_format_cbt_gz == RA8__MDL__FORMAT__FORMAT_CBT_GZ);
static_assert((uint32_t)k_mdl_format_epub == RA8__MDL__FORMAT__FORMAT_EPUB);
static_assert((uint32_t)k_mdl_format_jof == RA8__MDL__FORMAT__FORMAT_JOF);
static_assert((uint32_t)k_mdl_format_rabook == RA8__MDL__FORMAT__FORMAT_RABOOK);
static_assert((uint32_t)k_mdl_format_invalid == RA8__MDL__FORMAT__FORMAT_INVALID);

typedef enum : uint8_t {
  k_mdl_take_accepted  = 1U, 
  k_mdl_take_chunk     = 2U, 
  k_mdl_take_cancelled = 3U, 
} mdl_take_kind_t;

typedef struct {
  ra8_c6link_t*      link;             
  ra8_mdl_session_t* session;          
  ra8_mdl_chunk_t*   chunk;            
  uint32_t           operation;        
  uint16_t           requested_bytes;  
  mdl_format_t       requested_format; 
  mdl_take_kind_t    kind;             
} mdl_take_ctx_t;

RA8_INTERNAL static bool internal_mdl_http_field_valid(const char* text, size_t cap)
{
  if (text == nullptr) {
    return true;
  }
  const size_t length = strnlen(text, cap);
  if (length >= cap) {
    return false;
  }
  for (size_t index = 0U; index < length; index++) {
    if ((text[index] == '\r') || (text[index] == '\n')) {
      return false;
    }
  }
  return true;
}

RA8_INTERNAL static bool internal_mdl_http_response_valid(const Ra8__Mdl__Chunk* msg)
{
  const bool empty = (msg->retry_after != nullptr) && (msg->retry_after[0] == '\0') &&
                     (msg->etag != nullptr) && (msg->etag[0] == '\0') &&
                     (msg->last_modified != nullptr) && (msg->last_modified[0] == '\0') &&
                     (msg->content_type != nullptr) && (msg->content_type[0] == '\0');
  if (msg->state != RA8__MDL__STATE__STATE_COMPLETE) {
    return (msg->http_status == 0) && empty;
  }
  return (msg->http_status >= (int32_t)k_ra8_mdl_http_status_min) &&
         (msg->http_status <= (int32_t)k_ra8_mdl_http_status_max) &&
         internal_mdl_http_field_valid(msg->retry_after, k_ra8_mdl_retry_after_max) &&
         internal_mdl_http_field_valid(msg->etag, k_ra8_mdl_etag_max) &&
         internal_mdl_http_field_valid(msg->last_modified, k_ra8_mdl_http_date_max) &&
         internal_mdl_http_field_valid(msg->content_type, k_ra8_mdl_content_type_max);
}

RA8_INTERNAL static void
internal_mdl_http_field_copy(char* destination, const char* source, size_t cap)
{
  const size_t length = strnlen(source, cap);
  memcpy(destination, source, length + 1U);
}

RA8_INTERNAL static ra8_err_t internal_mdl_accept_chunk(mdl_take_ctx_t*        take,
                                                        const Ra8__Mdl__Chunk* msg)
{
  *take->chunk = (ra8_mdl_chunk_t){.job_id      = msg->job_id,
                                   .sequence    = msg->sequence,
                                   .offset      = msg->offset,
                                   .total_bytes = msg->total_bytes,
                                   .state       = (ra8_mdl_state_t)msg->state,
                                   .status      = (ra8_err_t)msg->status,
                                   .data_len    = (uint16_t)msg->data.len,
                                   .has_sha256  = (msg->sha256.len == k_ra8_mdl_sha256_bytes)};
  if (msg->data.len != 0U) {
    memcpy(take->chunk->data, msg->data.data, msg->data.len);
  }
  if (take->chunk->has_sha256) {
    memcpy(take->chunk->sha256, msg->sha256.data, k_ra8_mdl_sha256_bytes);
  }
  if (msg->state == RA8__MDL__STATE__STATE_COMPLETE) {
    take->chunk->response.status = msg->http_status;
    internal_mdl_http_field_copy(take->chunk->response.retry_after,
                                 msg->retry_after,
                                 sizeof(take->chunk->response.retry_after));
    internal_mdl_http_field_copy(take->chunk->response.etag,
                                 msg->etag,
                                 sizeof(take->chunk->response.etag));
    internal_mdl_http_field_copy(take->chunk->response.last_modified,
                                 msg->last_modified,
                                 sizeof(take->chunk->response.last_modified));
    internal_mdl_http_field_copy(take->chunk->response.content_type,
                                 msg->content_type,
                                 sizeof(take->chunk->response.content_type));
  }
  take->session->next_offset += msg->data.len;
  take->session->next_sequence += 1U;
  if ((msg->state == RA8__MDL__STATE__STATE_COMPLETE) ||
      (msg->state == RA8__MDL__STATE__STATE_CANCELLED) ||
      (msg->state == RA8__MDL__STATE__STATE_FAILED)) {
    take->session->active = false;
  }
  return (msg->state == RA8__MDL__STATE__STATE_FAILED) ? (ra8_err_t)msg->status : k_ra8_ok;
}

RA8_INTERNAL static bool internal_mdl_chunk_semantics_valid(const Ra8__Mdl__Chunk* msg)
{
  if (msg->data.len > (UINT64_MAX - msg->offset)) {
    return false;
  }
  const uint64_t end               = msg->offset + msg->data.len;
  const bool     total_covers_data = (msg->total_bytes == 0U) || (end <= msg->total_bytes);
  if (!total_covers_data) {
    return false;
  }
  if (!internal_mdl_http_response_valid(msg)) {
    return false;
  }
  switch (msg->state) {
    case RA8__MDL__STATE__STATE_DOWNLOADING:
      return (msg->status == 0) && (msg->data.len != 0U) && (msg->sha256.len == 0U);
    case RA8__MDL__STATE__STATE_COMPLETE:
      return (msg->status == 0) && (msg->data.len == 0U) &&
             (msg->sha256.len == k_ra8_mdl_sha256_bytes) && (msg->sha256.data != nullptr) &&
             ((msg->total_bytes == 0U) || (msg->total_bytes == end));
    case RA8__MDL__STATE__STATE_CANCELLED:
      return (msg->status == 0) && (msg->data.len == 0U) && (msg->sha256.len == 0U);
    case RA8__MDL__STATE__STATE_FAILED:
      return (msg->status > 0) && (msg->status <= UINT16_MAX) && (msg->data.len == 0U) &&
             (msg->sha256.len == 0U);
    default:
      return false;
  }
}

RA8_INTERNAL static ra8_err_t internal_mdl_take_accepted(mdl_take_ctx_t*            take,
                                                         const ProtobufCBinaryData* data)
{
  ProtobufCAllocator alloc = {};
  priv_c6link_arena_bind(&alloc, take->link);
  Ra8__Mdl__Accepted* msg = ra8__mdl__accepted__unpack(&alloc, data->len, data->data);
  if (msg == nullptr) {
    return k_ra8_err_protocol_error;
  }
  const bool valid = (msg->base.n_unknown_fields == 0U) &&
                     (msg->protocol_version == k_ra8_mdl_protocol_version) && (msg->job_id != 0U) &&
                     (msg->max_chunk_bytes != 0U) &&
                     (msg->max_chunk_bytes <= k_ra8_mdl_chunk_data_max) &&
                     ((uint32_t)msg->format == (uint32_t)take->requested_format);
  if (valid) {
    *take->session = (ra8_mdl_session_t){
      .job_id          = msg->job_id,
      .next_sequence   = 0U,
      .next_offset     = 0U,
      .max_chunk_bytes = msg->max_chunk_bytes,
      .format          = take->requested_format,
      .active          = true,
    };
  }
  ra8__mdl__accepted__free_unpacked(msg, &alloc);
  return valid ? k_ra8_ok : k_ra8_err_protocol_error;
}

RA8_INTERNAL static ra8_err_t internal_mdl_take_chunk(mdl_take_ctx_t*            take,
                                                      const ProtobufCBinaryData* data)
{
  ProtobufCAllocator alloc = {};
  priv_c6link_arena_bind(&alloc, take->link);
  Ra8__Mdl__Chunk* msg = ra8__mdl__chunk__unpack(&alloc, data->len, data->data);
  if (msg == nullptr) {
    return k_ra8_err_protocol_error;
  }
  const bool valid =
    (msg->base.n_unknown_fields == 0U) && (msg->protocol_version == k_ra8_mdl_protocol_version) &&
    (msg->job_id == take->session->job_id) && (msg->sequence == take->session->next_sequence) &&
    (msg->offset == take->session->next_offset) && (msg->data.len <= take->requested_bytes) &&
    (msg->data.len <= k_ra8_mdl_chunk_data_max) &&
    ((msg->data.len == 0U) || (msg->data.data != nullptr)) &&
    internal_mdl_chunk_semantics_valid(msg);
  const ra8_err_t result = valid ? internal_mdl_accept_chunk(take, msg) : k_ra8_err_protocol_error;
  ra8__mdl__chunk__free_unpacked(msg, &alloc);
  return result;
}

RA8_INTERNAL static ra8_err_t
internal_mdl_take_cancelled(mdl_take_ctx_t* take, const uint8_t* data, size_t len)
{
  ProtobufCAllocator alloc = {};
  priv_c6link_arena_bind(&alloc, take->link);
  Ra8__Mdl__Cancelled* msg = ra8__mdl__cancelled__unpack(&alloc, len, data);
  if (msg == nullptr) {
    return k_ra8_err_protocol_error;
  }
  const bool valid = (msg->base.n_unknown_fields == 0U) &&
                     (msg->protocol_version == k_ra8_mdl_protocol_version) &&
                     (msg->job_id == take->session->job_id) && (msg->status == 0);
  if (valid) {
    take->session->active = false;
  }
  ra8__mdl__cancelled__free_unpacked(msg, &alloc);
  return valid ? k_ra8_ok : k_ra8_err_protocol_error;
}

RA8_INTERNAL static ra8_err_t internal_mdl_take_response(void* ctx, const void* msg_v)
{
  mdl_take_ctx_t*         take = (mdl_take_ctx_t*)ctx;
  const Rpc*              msg  = (const Rpc*)msg_v;
  const RpcRespCustomRpc* body = msg->resp_custom_rpc;
  if ((body == nullptr) || (body->custom_msg_id != take->operation)) {
    return k_ra8_err_protocol_error;
  }
  const ra8_err_t remote = priv_c6link_resp(take->link, take->operation, body->resp);
  if (remote != k_ra8_ok) {
    return remote;
  }
  // mcdc-deactivated: internal_mdl_take_response empty-body guard; the length operand is constant-false whenever it is evaluated. protobuf-c's unpack sets a bytes field's `data` pointer to NULL for every zero-length field (`else { bd->data = NULL; }` in parse_required_member), so a decoded body of length zero always arrives with a null pointer and is consumed by the first operand; reaching the second requires a non-null pointer, which the same code only produces when `len > 0`. A modelled co-processor that puts a present but empty body on the wire -- exercised by test_ra8_c6link_mdl_decode.c -- decodes to (null, 0) like an omitted one.
  if ((body->data.data == nullptr) || (body->data.len == 0U)) {
    return k_ra8_err_protocol_error;
  }
  switch (take->kind) {
    case k_mdl_take_accepted:
      return internal_mdl_take_accepted(take, &body->data);
    case k_mdl_take_chunk:
      return internal_mdl_take_chunk(take, &body->data);
    case k_mdl_take_cancelled:
      return internal_mdl_take_cancelled(take, body->data.data, body->data.len);
    default:
      return k_ra8_err_protocol_error;
  }
}
 
/* protobuf-c's pack-only binary-data ABI still declares its byte pointer
 * mutable. */
// NOLINTBEGIN(readability-non-const-parameter) -- interface contract fixes this writable pointer type.
RA8_INTERNAL static ra8_err_t internal_mdl_call(ra8_c6link_t*   link,
                                                uint32_t        operation,
                                                uint8_t*        data,
                                                size_t          data_len,
                                                mdl_take_ctx_t* take)
{
  RpcReqCustomRpc body = RPC__REQ__CUSTOM_RPC__INIT;
  body.custom_msg_id   = operation;
  body.data            = (ProtobufCBinaryData){.len = data_len, .data = data};
 
  Rpc req            = RPC__INIT;
  req.msg_type       = RPC_TYPE__Req;
  req.msg_id         = RPC_ID__Req_CustomRpc;
  req.payload_case   = RPC__PAYLOAD_REQ_CUSTOM_RPC;
  req.req_custom_rpc = &body;
  take->link         = link;
  take->operation    = operation;
  return priv_c6link_rpc_call(link,
                              &req,
                              (uint32_t)RPC_ID__Resp_CustomRpc,
                              internal_mdl_take_response,
                              take);
}
// NOLINTEND(readability-non-const-parameter)
 
RA8_TEST_HELPER ra8_err_t ra8_c6link_mdl_take_cancelled_test(ra8_c6link_t*      link,
                                                             ra8_mdl_session_t* session,
                                                             const uint8_t*     packed,
                                                             size_t             len)
{
  mdl_take_ctx_t take = {.link = link, .session = session, .kind = k_mdl_take_cancelled};
  return internal_mdl_take_cancelled(&take, packed, len);
}
 
RA8_TEST_HELPER bool ra8_c6link_mdl_http_field_valid_test(const char* text, size_t cap)
{
  return internal_mdl_http_field_valid(text, cap);
}
 
RA8_TEST_HELPER bool ra8_c6link_mdl_http_response_valid_test(const Ra8__Mdl__Chunk* msg)
{
  return internal_mdl_http_response_valid(msg);
}
 
RA8_TEST_HELPER bool ra8_c6link_mdl_chunk_semantics_valid_test(const Ra8__Mdl__Chunk* msg)
{
  return internal_mdl_chunk_semantics_valid(msg);
}

RA8_INTERNAL static ra8_err_t internal_mdl_start_request_valid(const ra8_mdl_request_t* request,
                                                               size_t*                  out_url_len)
{
  if ((request == nullptr) || (request->url == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  const size_t https_prefix_len = sizeof("https://") - 1U;
  const size_t url_len          = strnlen(request->url, k_ra8_mdl_url_max);
  if ((url_len == 0U) || (url_len >= k_ra8_mdl_url_max) ||
      (strncmp(request->url, "https://", https_prefix_len) != 0) ||
      (request->url[https_prefix_len] == '\0')) {
    return k_ra8_err_invalid_arg;
  }
  if (((uint32_t)request->format > (uint32_t)k_mdl_format_rabook) ||
      (request->http.timeout_ms > k_ra8_mdl_timeout_ms_max) ||
      !internal_mdl_http_field_valid(request->http.user_agent, k_ra8_mdl_user_agent_max) ||
      !internal_mdl_http_field_valid(request->http.referer, k_ra8_mdl_referer_max) ||
      !internal_mdl_http_field_valid(request->http.if_none_match, k_ra8_mdl_etag_max) ||
      !internal_mdl_http_field_valid(request->http.if_modified_since, k_ra8_mdl_http_date_max)) {
    return k_ra8_err_invalid_arg;
  }
  *out_url_len = url_len;
  return k_ra8_ok;
}

typedef struct {
  char user_agent[k_ra8_mdl_user_agent_max];       
  char referer[k_ra8_mdl_referer_max];             
  char if_none_match[k_ra8_mdl_etag_max];          
  char if_modified_since[k_ra8_mdl_http_date_max]; 
} mdl_http_headers_t;

RA8_INTERNAL static void internal_mdl_stage_headers(const ra8_mdl_http_policy_t* http,
                                                    mdl_http_headers_t*          out)
{
  if (http->user_agent != nullptr) {
    memcpy(out->user_agent, http->user_agent, strlen(http->user_agent) + 1U);
  }
  if (http->referer != nullptr) {
    memcpy(out->referer, http->referer, strlen(http->referer) + 1U);
  }
  if (http->if_none_match != nullptr) {
    memcpy(out->if_none_match, http->if_none_match, strlen(http->if_none_match) + 1U);
  }
  if (http->if_modified_since != nullptr) {
    memcpy(out->if_modified_since, http->if_modified_since, strlen(http->if_modified_since) + 1U);
  }
}
 
ra8_err_t ra8_c6link_mdl_start_request(ra8_c6link_t*            link,
                                       const ra8_mdl_request_t* request,
                                       ra8_mdl_session_t*       session)
{
  if ((link == nullptr) || (session == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  size_t          url_len = 0U;
  const ra8_err_t valid   = internal_mdl_start_request_valid(request, &url_len);
  if (valid != k_ra8_ok) {
    return valid;
  }
  *session = (ra8_mdl_session_t){};
  char url_copy[k_ra8_mdl_url_max];
  memcpy(url_copy, request->url, url_len + 1U);
  mdl_http_headers_t headers = {};
  internal_mdl_stage_headers(&request->http, &headers);
  Ra8__Mdl__StartRequest inner;
  ra8__mdl__start_request__init(&inner);
  inner.protocol_version  = k_ra8_mdl_protocol_version;
  inner.url               = url_copy;
  inner.format            = (Ra8__Mdl__Format)request->format;
  inner.user_agent        = headers.user_agent;
  inner.referer           = headers.referer;
  inner.if_none_match     = headers.if_none_match;
  inner.if_modified_since = headers.if_modified_since;
  inner.timeout_ms        = request->http.timeout_ms;
  uint8_t* const data     = link->mdl_request;
  const size_t   packed   = ra8__mdl__start_request__get_packed_size(&inner);
  // mcdc-deactivated: ra8_c6link_mdl_start_request codec self-consistency guard; all three conditions are constant-false on every reachable path, so this is a fail-closed backstop against a codec defect rather than an input class. get_packed_size() counts a message whose protocol_version is the non-zero k_ra8_mdl_protocol_version, so it never reports 0; k_ra8_mdl_request_bytes_max is the exact sum of every bounded field plus 96 bytes of tag and varint headroom, and each field was bounded before this point, so the packed message cannot exceed link->mdl_request; and protobuf-c pack() returns exactly what get_packed_size() computed for the same message.
  if ((packed == 0U) || (packed > sizeof(link->mdl_request)) ||
      (ra8__mdl__start_request__pack(&inner, data) != packed)) {
    return k_ra8_err_invalid_size;
  }
  mdl_take_ctx_t take = {.session          = session,
                         .requested_format = request->format,
                         .kind             = k_mdl_take_accepted};
  return internal_mdl_call(link, k_ra8_mdl_rpc_start, data, packed, &take);
}
 
ra8_err_t ra8_c6link_mdl_start(ra8_c6link_t*      link,
                               const char*        url,
                               mdl_format_t       format,
                               ra8_mdl_session_t* session)
{
  const ra8_mdl_request_t request = {.url = url, .format = format};
  return ra8_c6link_mdl_start_request(link, &request, session);
}
 
ra8_err_t ra8_c6link_mdl_next(ra8_c6link_t*      link,
                              ra8_mdl_session_t* session,
                              uint16_t           max_bytes,
                              ra8_mdl_chunk_t*   chunk)
{
  if ((link == nullptr) || (session == nullptr) || (chunk == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  if (!session->active || (session->job_id == 0U)) {
    return k_ra8_err_invalid_state;
  }
  if ((max_bytes == 0U) || (max_bytes > session->max_chunk_bytes) ||
      (max_bytes > k_ra8_mdl_chunk_data_max)) {
    return k_ra8_err_invalid_size;
  }
  *chunk                      = (ra8_mdl_chunk_t){};
  Ra8__Mdl__NextRequest inner = RA8__MDL__NEXT_REQUEST__INIT;
  inner.protocol_version      = k_ra8_mdl_protocol_version;
  inner.job_id                = session->job_id;
  inner.acknowledged_offset   = session->next_offset;
  inner.max_bytes             = max_bytes;
  uint8_t* const data         = link->mdl_request;
  const size_t   packed       = ra8__mdl__next_request__get_packed_size(&inner);
  // mcdc-deactivated: ra8_c6link_mdl_next codec self-consistency guard; all three conditions are constant-false on every reachable path, so this is a fail-closed backstop against a codec defect rather than an input class. get_packed_size() counts a message whose protocol_version is the non-zero k_ra8_mdl_protocol_version, so it never reports 0; k_ra8_mdl_request_bytes_max is the exact sum of every bounded field plus 96 bytes of tag and varint headroom, and each field was bounded before this point, so the packed message cannot exceed link->mdl_request; and protobuf-c pack() returns exactly what get_packed_size() computed for the same message.
  if ((packed == 0U) || (packed > sizeof(link->mdl_request)) ||
      (ra8__mdl__next_request__pack(&inner, data) != packed)) {
    return k_ra8_err_invalid_size;
  }
  mdl_take_ctx_t take = {.session         = session,
                         .chunk           = chunk,
                         .requested_bytes = max_bytes,
                         .kind            = k_mdl_take_chunk};
  return internal_mdl_call(link, k_ra8_mdl_rpc_next, data, packed, &take);
}
 
ra8_err_t ra8_c6link_mdl_cancel(ra8_c6link_t* link, ra8_mdl_session_t* session)
{
  if ((link == nullptr) || (session == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  if (!session->active || (session->job_id == 0U)) {
    return k_ra8_err_invalid_state;
  }
  Ra8__Mdl__CancelRequest inner = RA8__MDL__CANCEL_REQUEST__INIT;
  inner.protocol_version        = k_ra8_mdl_protocol_version;
  inner.job_id                  = session->job_id;
  uint8_t* const data           = link->mdl_request;
  const size_t   packed         = ra8__mdl__cancel_request__get_packed_size(&inner);
  // mcdc-deactivated: ra8_c6link_mdl_cancel codec self-consistency guard; all three conditions are constant-false on every reachable path, so this is a fail-closed backstop against a codec defect rather than an input class. get_packed_size() counts a message whose protocol_version is the non-zero k_ra8_mdl_protocol_version, so it never reports 0; k_ra8_mdl_request_bytes_max is the exact sum of every bounded field plus 96 bytes of tag and varint headroom, and each field was bounded before this point, so the packed message cannot exceed link->mdl_request; and protobuf-c pack() returns exactly what get_packed_size() computed for the same message.
  if ((packed == 0U) || (packed > sizeof(link->mdl_request)) ||
      (ra8__mdl__cancel_request__pack(&inner, data) != packed)) {
    return k_ra8_err_invalid_size;
  }
  mdl_take_ctx_t take = {.session = session, .kind = k_mdl_take_cancelled};
  return internal_mdl_call(link, k_ra8_mdl_rpc_cancel, data, packed, &take);
}