/*
 * Copyright (c) 2026 Jitendra Bhati
 *
 * SPDX-License-Identifier: BSD-2-Clause
 */

/*
 * Regression tests for specific FreeBSD bug reports fixed in fts(3).
 */

#include <sys/stat.h>
#include <sys/time.h>

#include <errno.h>
#include <fcntl.h>
#include <fts.h>
#include <pthread.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

#include <atf-c.h>

/*
 * Thrash function for file-based race tests: repeatedly creates and
 * deletes a regular file at the given path.
 */
static volatile bool race_stop;

static void *
race_thrash(void *arg)
{
	const char *path = arg;

	while (!race_stop) {
		(void)close(creat(path, 0644));
		(void)unlink(path);
	}
	return (NULL);
}

/*
 * Thrash function for directory-based race tests: repeatedly removes
 * and recreates a directory at the given path.
 */
static void *
dir_thrash(void *arg)
{
	const char *path = arg;

	while (!race_stop) {
		(void)rmdir(path);
		(void)mkdir(path, 0755);
	}
	return (NULL);
}

/*
 * PR 45723: A directory with read but no execute permission must be
 * traversed.  Before the fix, fts_build() gave up silently when
 * chdir() failed, producing no output at all.  The fix falls back to
 * FTS_DONTCHDIR mode so the directory is still traversed using full
 * relative paths.
 *
 * Requires an unprivileged user because root ignores permissions.
 */
ATF_TC(read_no_exec_dir);
ATF_TC_HEAD(read_no_exec_dir, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "directory with read but no execute is traversed via "
	    "FTS_DONTCHDIR fallback");
	atf_tc_set_md_var(tc, "require.user", "unprivileged");
}
ATF_TC_BODY(read_no_exec_dir, tc)
{
	char *paths[] = { "dir", NULL };
	FTS *fts;
	FTSENT *ent;
	bool saw_d, saw_file;

	ATF_REQUIRE_EQ(0, mkdir("dir", 0755));
	ATF_REQUIRE_EQ(0, close(creat("dir/file", 0644)));
	ATF_REQUIRE_EQ(0, chmod("dir", 0400));

	ATF_REQUIRE((fts = fts_open(paths, FTS_PHYSICAL, NULL)) != NULL);

	/*
	 * Before the fix, zero entries were produced.  After the fix,
	 * fts falls back to FTS_DONTCHDIR and traverses using full paths.
	 * Verify the directory is not silently skipped.
	 */
	saw_d = false;
	saw_file = false;
	while ((ent = fts_read(fts)) != NULL) {
		if (ent->fts_info == FTS_D &&
		    strcmp(ent->fts_name, "dir") == 0)
			saw_d = true;
		if (strcmp(ent->fts_name, "file") == 0)
			saw_file = true;
	}

	ATF_CHECK_MSG(saw_d,
	    "FTS_D not returned for directory with mode 0400");
	ATF_CHECK_MSG(saw_file,
	    "file inside mode 0400 directory was not visited");

	ATF_REQUIRE_EQ_MSG(0, fts_close(fts), "fts_close(): %m");
}

/*
 * PR 196724: FTS_SLNONE must not be returned for a non-symlink.
 *
 * The fix ensures that FTS_SLNONE is only returned when lstat confirms
 * the entry is actually a symlink.  Exercised by a time-bounded race
 * where a background thread creates and deletes a regular file while
 * fts traverses with FTS_LOGICAL.
 */
ATF_TC(no_slnone_for_nonsymlink);
ATF_TC_HEAD(no_slnone_for_nonsymlink, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "FTS_SLNONE must not be returned for a non-symlink");
}
ATF_TC_BODY(no_slnone_for_nonsymlink, tc)
{
	pthread_t thr;
	char *paths[] = { "dir", NULL };
	FTS *fts;
	FTSENT *ent;
	struct timespec start, now, elapsed;

	ATF_REQUIRE_EQ(0, mkdir("dir", 0755));
	ATF_REQUIRE_EQ(0, symlink("nonexistent", "dir/dead"));

	race_stop = false;
	ATF_REQUIRE_EQ(0, pthread_create(&thr, NULL, race_thrash,
	    __DECONST(void *, "dir/victim")));

	clock_gettime(CLOCK_MONOTONIC, &start);
	for (;;) {
		clock_gettime(CLOCK_MONOTONIC, &now);
		timespecsub(&now, &start, &elapsed);
		if (elapsed.tv_sec >= 1)
			break;
		fts = fts_open(paths, FTS_LOGICAL, NULL);
		ATF_REQUIRE(fts != NULL);
		while ((ent = fts_read(fts)) != NULL) {
			if (ent->fts_info == FTS_SLNONE &&
			    ent->fts_statp->st_mode != 0 &&
			    !S_ISLNK(ent->fts_statp->st_mode))
				ATF_CHECK_MSG(0,
				    "FTS_SLNONE returned for non-symlink '%s'",
				    ent->fts_name);
		}
		fts_close(fts);
	}

	race_stop = true;
	pthread_join(thr, NULL);
}

/*
 * PR 262038: fts_build() must detect readdir(2) errors and not treat
 * them as end-of-directory.  The man page specifies that FTS_DNR must
 * immediately follow FTS_D, in place of FTS_DP.
 *
 * Requires an unprivileged user because root ignores permissions.
 */
ATF_TC(readdir_error_detected);
ATF_TC_HEAD(readdir_error_detected, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "readdir errors produce FTS_DNR with fts_errno set");
	atf_tc_set_md_var(tc, "require.user", "unprivileged");
}
ATF_TC_BODY(readdir_error_detected, tc)
{
	char *paths[] = { "dir", NULL };
	FTS *fts;
	FTSENT *ent;

	ATF_REQUIRE_EQ(0, mkdir("dir", 0755));
	ATF_REQUIRE_EQ(0, close(creat("dir/file", 0644)));

	/*
	 * Mode 0100: execute only, no read.  chdir() succeeds but
	 * opendir/readdir fails.  fts must return FTS_D then FTS_DNR
	 * (not FTS_DP) per the man page.
	 */
	ATF_REQUIRE_EQ(0, chmod("dir", 0100));

	ATF_REQUIRE((fts = fts_open(paths, FTS_PHYSICAL, NULL)) != NULL);

	ATF_REQUIRE((ent = fts_read(fts)) != NULL);
	ATF_CHECK_EQ_MSG(FTS_D, ent->fts_info,
	    "expected FTS_D, got %d", ent->fts_info);

	ATF_REQUIRE((ent = fts_read(fts)) != NULL);
	ATF_CHECK_EQ_MSG(FTS_DNR, ent->fts_info,
	    "expected FTS_DNR, got %d", ent->fts_info);
	ATF_CHECK_MSG(ent->fts_errno != 0,
	    "FTS_DNR must have non-zero fts_errno");

	ATF_REQUIRE_EQ_MSG(NULL, fts_read(fts),
	    "expected NULL after FTS_DNR");

	ATF_REQUIRE_EQ_MSG(0, fts_close(fts), "fts_close(): %m");
}

/*
 * SVN r246641: fts_safe_changedir() uses O_DIRECTORY to prevent a
 * TOCTOU substitution attack where a directory is replaced with a
 * non-directory between stat and open.  Exercised by a time-bounded
 * race where a background thread repeatedly removes and recreates
 * dir/sub while fts traverses.
 */
ATF_TC(odirectory_changedir);
ATF_TC_HEAD(odirectory_changedir, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "fts_safe_changedir handles concurrent dir/file substitution");
}
ATF_TC_BODY(odirectory_changedir, tc)
{
	pthread_t thr;
	char *paths[] = { "dir", NULL };
	FTS *fts;
	struct timespec start, now, elapsed;

	ATF_REQUIRE_EQ(0, mkdir("dir", 0755));
	ATF_REQUIRE_EQ(0, mkdir("dir/sub", 0755));
	ATF_REQUIRE_EQ(0, close(creat("dir/sub/file", 0644)));

	/*
	 * Background thread races to remove and recreate dir/sub as a
	 * directory.  With O_DIRECTORY the open fails safely if dir/sub
	 * is temporarily absent or replaced.
	 */
	race_stop = false;
	ATF_REQUIRE_EQ(0, pthread_create(&thr, NULL, dir_thrash,
	    __DECONST(void *, "dir/sub")));

	clock_gettime(CLOCK_MONOTONIC, &start);
	for (;;) {
		clock_gettime(CLOCK_MONOTONIC, &now);
		timespecsub(&now, &start, &elapsed);
		if (elapsed.tv_sec >= 1)
			break;
		fts = fts_open(paths, FTS_PHYSICAL, NULL);
		ATF_REQUIRE(fts != NULL);
		while (fts_read(fts) != NULL)
			;
		fts_close(fts);
	}

	race_stop = true;
	pthread_join(thr, NULL);
}

/*
 * SVN r261589: fts must not double-free when the directory tree is
 * concurrently modified.  Exercised by a time-bounded race where a
 * background thread creates and deletes a file during traversal.
 */
ATF_TC(concurrent_modification);
ATF_TC_HEAD(concurrent_modification, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "no crash when tree modified during traversal");
}
ATF_TC_BODY(concurrent_modification, tc)
{
	pthread_t thr;
	char *paths[] = { "dir", NULL };
	FTS *fts;
	struct timespec start, now, elapsed;

	ATF_REQUIRE_EQ(0, mkdir("dir", 0755));
	ATF_REQUIRE_EQ(0, close(creat("dir/stable", 0644)));

	race_stop = false;
	ATF_REQUIRE_EQ(0, pthread_create(&thr, NULL, race_thrash,
	    __DECONST(void *, "dir/victim")));

	clock_gettime(CLOCK_MONOTONIC, &start);
	for (;;) {
		clock_gettime(CLOCK_MONOTONIC, &now);
		timespecsub(&now, &start, &elapsed);
		if (elapsed.tv_sec >= 1)
			break;
		fts = fts_open(paths, FTS_PHYSICAL, NULL);
		ATF_REQUIRE(fts != NULL);
		while (fts_read(fts) != NULL)
			;
		fts_close(fts);
	}

	race_stop = true;
	pthread_join(thr, NULL);
}

ATF_TP_ADD_TCS(tp)
{
	ATF_TP_ADD_TC(tp, read_no_exec_dir);
	ATF_TP_ADD_TC(tp, no_slnone_for_nonsymlink);
	ATF_TP_ADD_TC(tp, readdir_error_detected);
	ATF_TP_ADD_TC(tp, odirectory_changedir);
	ATF_TP_ADD_TC(tp, concurrent_modification);

	return (atf_no_error());
}