ra8_c6link_mdl_service.c

Go to the documentation of this file.

 
#include <stddef.h>
#include <stdint.h>
#include <string.h>
 
#include "ra8_attributes.h"
#include "ra8_c6link_mdl_msg.h"
#include "ra8_c6link_mdl_service_internal.h"
#include "ra8_media_download.pb-c.h"
 
static_assert((uint32_t)k_mdl_format_loose == RA8__MDL__FORMAT__FORMAT_LOOSE);
static_assert((uint32_t)k_mdl_format_cbz == RA8__MDL__FORMAT__FORMAT_CBZ);
static_assert((uint32_t)k_mdl_format_cbt == RA8__MDL__FORMAT__FORMAT_CBT);
static_assert((uint32_t)k_mdl_format_cbr == RA8__MDL__FORMAT__FORMAT_CBR);
static_assert((uint32_t)k_mdl_format_cbt_xz == RA8__MDL__FORMAT__FORMAT_CBT_XZ);
static_assert((uint32_t)k_mdl_format_cbt_gz == RA8__MDL__FORMAT__FORMAT_CBT_GZ);
static_assert((uint32_t)k_mdl_format_epub == RA8__MDL__FORMAT__FORMAT_EPUB);
static_assert((uint32_t)k_mdl_format_jof == RA8__MDL__FORMAT__FORMAT_JOF);
static_assert((uint32_t)k_mdl_format_rabook == RA8__MDL__FORMAT__FORMAT_RABOOK);
static_assert((uint32_t)k_mdl_format_invalid == RA8__MDL__FORMAT__FORMAT_INVALID);

typedef enum : uint16_t {
  k_mdl_decode_align_mask = k_ra8_mdl_decode_align - 1U, 
} mdl_svc_const_t;
 
/* The worst-case response sizing below reads one bounded run of filler through
 * four header pointers of different lengths, so the run must be at least as
 * long as the longest of them. */
static_assert(k_ra8_mdl_retry_after_max <= k_ra8_mdl_etag_max);
static_assert(k_ra8_mdl_http_date_max <= k_ra8_mdl_etag_max);
static_assert(k_ra8_mdl_content_type_max <= k_ra8_mdl_etag_max);

RA8_INTERNAL static bool internal_mdl_request_field_valid(const char* text, size_t cap)
{
  if (text == nullptr) {
    return false;
  }
  const size_t length = strnlen(text, cap);
  if (length >= cap) {
    return false;
  }
  for (size_t index = 0U; index < length; index++) {
    if ((text[index] == '\r') || (text[index] == '\n')) {
      return false;
    }
  }
  return true;
}

RA8_INTERNAL static bool internal_mdl_response_valid(const ra8_mdl_http_response_t* response)
{
  return (response->status >= (int32_t)k_ra8_mdl_http_status_min) &&
         (response->status <= (int32_t)k_ra8_mdl_http_status_max) &&
         internal_mdl_request_field_valid(response->retry_after, sizeof(response->retry_after)) &&
         internal_mdl_request_field_valid(response->etag, sizeof(response->etag)) &&
         internal_mdl_request_field_valid(response->last_modified,
                                          sizeof(response->last_modified)) &&
         internal_mdl_request_field_valid(response->content_type, sizeof(response->content_type));
}
 
RA8_PRIV bool priv_c6link_mdl_decode_allocation_fits(size_t used, size_t len, size_t capacity)
{
  if (len > (SIZE_MAX - k_mdl_decode_align_mask)) {
    return false;
  }
  const size_t aligned = (len + k_mdl_decode_align_mask) & ~(size_t)k_mdl_decode_align_mask;
  return (aligned <= capacity) && (used <= (capacity - aligned));
}

RA8_INTERNAL static void* internal_mdl_decode_alloc(void* data, size_t len)
{
  ra8_mdl_decode_arena_t* arena = (ra8_mdl_decode_arena_t*)data;
  if (!priv_c6link_mdl_decode_allocation_fits(arena->used, len, sizeof(arena->bytes))) {
    return nullptr;
  }
  const size_t aligned = (len + k_mdl_decode_align_mask) & ~(size_t)k_mdl_decode_align_mask;
  void*        out     = &arena->bytes[arena->used];
  arena->used += aligned;
  return out;
}

RA8_INTERNAL static void internal_mdl_decode_free(void* data, void* ptr)
{
  (void)data;
  (void)ptr;
}

RA8_INTERNAL static ra8_err_t internal_mdl_check_response_size(size_t len, size_t response_cap)
{
  if ((len == 0U) || (len > response_cap)) {
    return k_ra8_err_invalid_size;
  }
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_mdl_pack_accepted(const Ra8__Mdl__Accepted* msg,
                                                         uint8_t*                  response,
                                                         size_t                    response_cap,
                                                         size_t*                   response_len)
{
  const size_t    len      = ra8__mdl__accepted__get_packed_size(msg);
  const ra8_err_t capacity = internal_mdl_check_response_size(len, response_cap);
  if (capacity != k_ra8_ok) {
    return capacity;
  }
  if (ra8__mdl__accepted__pack(msg, response) != len) {
    return k_ra8_err_validation_failed;
  }
  *response_len = len;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_mdl_pack_chunk(const Ra8__Mdl__Chunk* msg,
                                                      uint8_t*               response,
                                                      size_t                 response_cap,
                                                      size_t*                response_len)
{
  const size_t    len      = ra8__mdl__chunk__get_packed_size(msg);
  const ra8_err_t capacity = internal_mdl_check_response_size(len, response_cap);
  if (capacity != k_ra8_ok) {
    return capacity;
  }
  if (ra8__mdl__chunk__pack(msg, response) != len) {
    return k_ra8_err_validation_failed;
  }
  *response_len = len;
  return k_ra8_ok;
}

RA8_INTERNAL static bool internal_mdl_start_valid(const Ra8__Mdl__StartRequest* request)
{
  if (request->url == nullptr) {
    return false;
  }
  const size_t https_prefix_len = sizeof("https://") - 1U;
  const size_t url_len          = strnlen(request->url, k_ra8_mdl_url_max);
  return (request->protocol_version == k_ra8_mdl_protocol_version) && (url_len != 0U) &&
         (url_len < k_ra8_mdl_url_max) &&
         (strncmp(request->url, "https://", https_prefix_len) == 0) &&
         (request->url[https_prefix_len] != '\0') &&
         ((uint32_t)request->format <= (uint32_t)RA8__MDL__FORMAT__FORMAT_RABOOK) &&
         (request->timeout_ms <= k_ra8_mdl_timeout_ms_max) &&
         internal_mdl_request_field_valid(request->user_agent, k_ra8_mdl_user_agent_max) &&
         internal_mdl_request_field_valid(request->referer, k_ra8_mdl_referer_max) &&
         internal_mdl_request_field_valid(request->if_none_match, k_ra8_mdl_etag_max) &&
         internal_mdl_request_field_valid(request->if_modified_since, k_ra8_mdl_http_date_max);
}

RA8_INTERNAL static ra8_err_t internal_mdl_dispatch_start(ra8_mdl_service_t*  service,
                                                          ProtobufCAllocator* alloc,
                                                          const uint8_t*      request,
                                                          size_t              request_len,
                                                          uint8_t*            response,
                                                          size_t              response_cap,
                                                          size_t*             response_len)
{
  Ra8__Mdl__StartRequest* req = ra8__mdl__start_request__unpack(alloc, request_len, request);
  if (req == nullptr) {
    return k_ra8_err_protocol_error;
  }
  if (req->base.n_unknown_fields != 0U) {
    return k_ra8_err_protocol_error;
  }
  if (!internal_mdl_start_valid(req)) {
    return k_ra8_err_invalid_arg;
  }
  if (service->active) {
    return k_ra8_err_busy;
  }
  uint32_t next_job_id = service->next_job_id + 1U;
  if (next_job_id == 0U) {
    next_job_id = 1U;
  }
  Ra8__Mdl__Accepted out = RA8__MDL__ACCEPTED__INIT;
  out.protocol_version   = k_ra8_mdl_protocol_version;
  out.job_id             = next_job_id;
  out.max_chunk_bytes    = k_ra8_mdl_chunk_data_max;
  out.format             = req->format;
  const ra8_err_t prepacked =
    internal_mdl_pack_accepted(&out, response, response_cap, response_len);
  if (prepacked != k_ra8_ok) {
    return prepacked;
  }
  const ra8_mdl_request_t backend_request = {
    .url    = req->url,
    .format = (mdl_format_t)req->format,
    .http   = {.user_agent        = req->user_agent,
               .referer           = req->referer,
               .if_none_match     = req->if_none_match,
               .if_modified_since = req->if_modified_since,
               .timeout_ms        = req->timeout_ms},
  };
  const ra8_err_t begun = service->backend.begin(service->backend.ctx, &backend_request);
  if (begun != k_ra8_ok) {
    *response_len = 0U;
    return begun;
  }
  service->next_job_id   = next_job_id;
  service->active_job_id = service->next_job_id;
  service->next_sequence = 0U;
  service->next_offset   = 0U;
  service->active_format = (mdl_format_t)req->format;
  service->active        = true;
  return k_ra8_ok;
}

typedef struct internal_mdl_next_read_t {
  uint8_t                 bytes[k_ra8_mdl_chunk_data_max]; 
  uint8_t                 digest[k_ra8_mdl_sha256_bytes];  
  uint16_t                got;                             
  uint64_t                total;                           
  uint64_t                end_offset;                      
  bool                    complete;                        
  ra8_mdl_http_response_t response;                        
} internal_mdl_next_read_t;

RA8_INTERNAL
static ra8_err_t internal_mdl_fail_job(ra8_mdl_service_t* service, ra8_err_t error)
{
  (void)service->backend.cancel(service->backend.ctx);
  service->active = false;
  return error;
}

RA8_INTERNAL
static ra8_err_t internal_mdl_next_capacity(uint32_t max_data, size_t response_cap)
{
  /* `get_packed_size()` reads a string field only through `strlen()` and a
   * bytes field only through its `len`, never through its `data` pointer
   * (protobuf-c `required_field_get_packed_size`). So one filler run measures
   * every header: a field of capacity `cap` takes the suffix at
   * `sizeof(filler) - cap`, whose length is exactly `cap - 1`. Six
   * separate worst-case buffers cost 1440 stack bytes and measured the same
   * numbers. */
  char filler[k_ra8_mdl_etag_max];
  memset(filler, 'x', sizeof(filler) - 1U);
  filler[sizeof(filler) - 1U] = '\0';
  Ra8__Mdl__Chunk data;
  ra8__mdl__chunk__init(&data);
  data.protocol_version = UINT32_MAX;
  data.job_id           = UINT32_MAX;
  data.sequence         = UINT32_MAX;
  data.offset           = UINT64_MAX;
  data.data             = (ProtobufCBinaryData){.len = max_data, .data = (uint8_t*)filler};
  data.total_bytes      = UINT64_MAX;
  data.state            = RA8__MDL__STATE__STATE_DOWNLOADING;
  const ra8_err_t data_fit =
    internal_mdl_check_response_size(ra8__mdl__chunk__get_packed_size(&data), response_cap);
  if (data_fit != k_ra8_ok) {
    return data_fit;
  }
 
  Ra8__Mdl__Chunk terminal;
  ra8__mdl__chunk__init(&terminal);
  terminal.protocol_version = UINT32_MAX;
  terminal.job_id           = UINT32_MAX;
  terminal.sequence         = UINT32_MAX;
  terminal.offset           = UINT64_MAX;
  terminal.total_bytes      = UINT64_MAX;
  terminal.state            = RA8__MDL__STATE__STATE_COMPLETE;
  terminal.sha256 =
    (ProtobufCBinaryData){.len = (size_t)k_ra8_mdl_sha256_bytes, .data = (uint8_t*)filler};
  terminal.http_status   = (int32_t)k_ra8_mdl_http_status_max;
  terminal.retry_after   = &filler[sizeof(filler) - k_ra8_mdl_retry_after_max];
  terminal.etag          = filler; /* the longest header: the whole run */
  terminal.last_modified = &filler[sizeof(filler) - k_ra8_mdl_http_date_max];
  terminal.content_type  = &filler[sizeof(filler) - k_ra8_mdl_content_type_max];
  return internal_mdl_check_response_size(ra8__mdl__chunk__get_packed_size(&terminal),
                                          response_cap);
}

RA8_INTERNAL
static ra8_err_t internal_mdl_read_next(ra8_mdl_service_t*        service,
                                        uint32_t                  max_data,
                                        internal_mdl_next_read_t* result)
{
  const ra8_err_t read = service->backend.read(service->backend.ctx,
                                               result->bytes,
                                               (uint16_t)max_data,
                                               &result->got,
                                               &result->total,
                                               &result->complete,
                                               result->digest,
                                               &result->response);
  if (read != k_ra8_ok) {
    return internal_mdl_fail_job(service, read);
  }
  const bool offset_overflow = service->next_offset > (UINT64_MAX - result->got);
  result->end_offset         = offset_overflow ? 0U : service->next_offset + result->got;
  bool total_invalid         = false;
  if (result->complete) {
    total_invalid = result->end_offset != result->total;
  } else if (result->total != 0U) {
    total_invalid = result->end_offset > result->total;
  }
  if ((result->got > max_data) || ((!result->complete) && (result->got == 0U)) ||
      (result->complete && (result->got != 0U)) || offset_overflow || total_invalid ||
      (service->next_sequence == UINT32_MAX) ||
      (result->complete && !internal_mdl_response_valid(&result->response)) ||
      (!result->complete && (result->response.status != 0))) {
    return internal_mdl_fail_job(service, k_ra8_err_protocol_error);
  }
  return k_ra8_ok;
}

RA8_INTERNAL static void internal_mdl_build_chunk(const ra8_mdl_service_t*  service,
                                                  internal_mdl_next_read_t* result,
                                                  Ra8__Mdl__Chunk*          out)
{
  ra8__mdl__chunk__init(out);
  out->protocol_version = k_ra8_mdl_protocol_version;
  out->job_id           = service->active_job_id;
  out->sequence         = service->next_sequence;
  out->offset           = service->next_offset;
  out->data             = (ProtobufCBinaryData){.len = result->got, .data = result->bytes};
  out->total_bytes      = result->total;
  out->state =
    result->complete ? RA8__MDL__STATE__STATE_COMPLETE : RA8__MDL__STATE__STATE_DOWNLOADING;
  out->status = 0;
  if (result->complete) {
    out->sha256      = (ProtobufCBinaryData){.len = k_ra8_mdl_sha256_bytes, .data = result->digest};
    out->http_status = result->response.status;
    out->retry_after = result->response.retry_after;
    out->etag        = result->response.etag;
    out->last_modified = result->response.last_modified;
    out->content_type  = result->response.content_type;
  }
}

RA8_INTERNAL static ra8_err_t internal_mdl_dispatch_next(ra8_mdl_service_t*  service,
                                                         ProtobufCAllocator* alloc,
                                                         const uint8_t*      request,
                                                         size_t              request_len,
                                                         uint8_t*            response,
                                                         size_t              response_cap,
                                                         size_t*             response_len)
{
  const Ra8__Mdl__NextRequest* req = ra8__mdl__next_request__unpack(alloc, request_len, request);
  if (req == nullptr) {
    return k_ra8_err_protocol_error;
  }
  if (req->base.n_unknown_fields != 0U) {
    return k_ra8_err_protocol_error;
  }
  if ((req->protocol_version != k_ra8_mdl_protocol_version) || !service->active ||
      (req->job_id != service->active_job_id) ||
      (req->acknowledged_offset != service->next_offset) || (req->max_bytes == 0U) ||
      (req->max_bytes > k_ra8_mdl_chunk_data_max)) {
    return k_ra8_err_invalid_state;
  }
 
  const ra8_err_t capacity = internal_mdl_next_capacity(req->max_bytes, response_cap);
  if (capacity != k_ra8_ok) {
    return capacity;
  }
 
  internal_mdl_next_read_t result = {};
  const ra8_err_t          read   = internal_mdl_read_next(service, req->max_bytes, &result);
  if (read != k_ra8_ok) {
    return read;
  }
 
  Ra8__Mdl__Chunk out;
  ra8__mdl__chunk__init(&out);
  internal_mdl_build_chunk(service, &result, &out);
  const ra8_err_t packed = internal_mdl_pack_chunk(&out, response, response_cap, response_len);
  if (packed != k_ra8_ok) {
    return internal_mdl_fail_job(service, packed);
  }
  service->next_offset += result.got;
  service->next_sequence += 1U;
  if (result.complete) {
    service->active = false;
  }
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_mdl_dispatch_cancel(ra8_mdl_service_t*  service,
                                                           ProtobufCAllocator* alloc,
                                                           const uint8_t*      request,
                                                           size_t              request_len,
                                                           uint8_t*            response,
                                                           size_t              response_cap,
                                                           size_t*             response_len)
{
  const Ra8__Mdl__CancelRequest* req =
    ra8__mdl__cancel_request__unpack(alloc, request_len, request);
  if (req == nullptr) {
    return k_ra8_err_protocol_error;
  }
  if (req->base.n_unknown_fields != 0U) {
    return k_ra8_err_protocol_error;
  }
  if ((req->protocol_version != k_ra8_mdl_protocol_version) || !service->active ||
      (req->job_id != service->active_job_id)) {
    return k_ra8_err_invalid_state;
  }
  Ra8__Mdl__Cancelled out  = RA8__MDL__CANCELLED__INIT;
  out.protocol_version     = k_ra8_mdl_protocol_version;
  out.job_id               = req->job_id;
  out.status               = 0;
  const size_t    len      = ra8__mdl__cancelled__get_packed_size(&out);
  const ra8_err_t capacity = internal_mdl_check_response_size(len, response_cap);
  if (capacity != k_ra8_ok) {
    return capacity;
  }
  if (ra8__mdl__cancelled__pack(&out, response) != len) {
    return k_ra8_err_validation_failed;
  }
  const ra8_err_t cancelled = service->backend.cancel(service->backend.ctx);
  if (cancelled != k_ra8_ok) {
    return cancelled;
  }
  service->active = false;
  *response_len   = len;
  return k_ra8_ok;
}
 
RA8_TEST_HELPER bool ra8_mdl_service_field_valid_test(const char* text, size_t cap)
{
  return internal_mdl_request_field_valid(text, cap);
}
 
RA8_TEST_HELPER bool ra8_mdl_service_response_valid_test(const ra8_mdl_http_response_t* response)
{
  return internal_mdl_response_valid(response);
}
 
RA8_TEST_HELPER ra8_err_t ra8_mdl_service_check_size_test(size_t len, size_t response_cap)
{
  return internal_mdl_check_response_size(len, response_cap);
}
 
ra8_err_t ra8_mdl_service_init(ra8_mdl_service_t* service, const ra8_mdl_service_backend_t* backend)
{
  if ((service == nullptr) || (backend == nullptr) || (backend->begin == nullptr) ||
      (backend->read == nullptr) || (backend->cancel == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  *service = (ra8_mdl_service_t){.backend = *backend};
  return k_ra8_ok;
}
 
ra8_err_t ra8_mdl_service_dispatch(void*          ctx,
                                   uint32_t       operation,
                                   const uint8_t* request,
                                   size_t         request_len,
                                   uint8_t*       response,
                                   size_t         response_cap,
                                   size_t*        response_len)
{
  if ((ctx == nullptr) || (request == nullptr) || (request_len == 0U) || (response == nullptr) ||
      (response_len == nullptr)) {
    return k_ra8_err_null_ptr;
  }
  *response_len              = 0U;
  ra8_mdl_service_t* service = (ra8_mdl_service_t*)ctx;
  /* Cleared here, not declared here: an automatic arena of this size put this
   * function over the 2048-byte first-party frame budget. Clearing the whole
   * object gives every dispatch the same empty arena the automatic one did. */
  service->arena           = (ra8_mdl_decode_arena_t){};
  ProtobufCAllocator alloc = {.alloc          = internal_mdl_decode_alloc,
                              .free           = internal_mdl_decode_free,
                              .allocator_data = &service->arena};
  switch (operation) {
    case k_ra8_mdl_rpc_start:
      return internal_mdl_dispatch_start(service,
                                         &alloc,
                                         request,
                                         request_len,
                                         response,
                                         response_cap,
                                         response_len);
    case k_ra8_mdl_rpc_next:
      return internal_mdl_dispatch_next(service,
                                        &alloc,
                                        request,
                                        request_len,
                                        response,
                                        response_cap,
                                        response_len);
    case k_ra8_mdl_rpc_cancel:
      return internal_mdl_dispatch_cancel(service,
                                          &alloc,
                                          request,
                                          request_len,
                                          response,
                                          response_cap,
                                          response_len);
    default:
      return k_ra8_err_not_supported;
  }
}