/*

  *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

  *  Copyright (C) 2007-2013 Sourcefire, Inc.

  *
  *  Authors: Nigel Horne

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.

  */

 #ifndef __PDF_H
 #define __PDF_H
 

 #include "others.h"

 #define PDF_FILTERLIST_MAX  64

 struct objstm_struct {
     uint32_t first;         // offset of first obj
     uint32_t current;       // offset of current obj
     uint32_t current_pair;  // offset of current pair describing id, location of object
     uint32_t length;        // total length of all objects (starting at first)
     uint32_t n;             // number of objects that should be found in the object stream
     uint32_t nobjs_found;   // number of objects actually found in the object stream
     char *streambuf;        // address of stream buffer, beginning with first obj pair
     size_t streambuf_len;   // length of stream buffer, includes pairs followed by actual objects
 };
 

 struct pdf_obj {
     uint32_t start;

     size_t size;

     uint32_t id;
     uint32_t flags;

     uint32_t statsflags;

     uint32_t numfilters;
     uint32_t filterlist[PDF_FILTERLIST_MAX];

     const char *stream;     // pointer to stream contained in object.
     size_t stream_size;      // size of stream contained in object.

     struct objstm_struct *objstm;  // Should be NULL unless the obj exists in an object stream (separate buffer)

     char *path;

 };

 enum pdf_array_type { PDF_ARR_UNKNOWN=0, PDF_ARR_STRING, PDF_ARR_ARRAY, PDF_ARR_DICT };
 enum pdf_dict_type { PDF_DICT_UNKNOWN=0, PDF_DICT_STRING, PDF_DICT_ARRAY, PDF_DICT_DICT };

 
 struct pdf_array_node {
     void *data;
     size_t datasz;
     enum pdf_array_type type;
 
     struct pdf_array_node *prev;
     struct pdf_array_node *next;
 };
 
 struct pdf_array {
     struct pdf_array_node *nodes;

     struct pdf_array_node *tail;

 };
 

 struct pdf_dict_node {
     char *key;
     void *value;
     size_t valuesz;
     enum pdf_dict_type type;
 
     struct pdf_dict_node *prev;
     struct pdf_dict_node *next;
 };
 
 struct pdf_dict {
     struct pdf_dict_node *nodes;
     struct pdf_dict_node *tail;
 };
 

 struct pdf_stats_entry {
     char *data;
 
     /* populated by pdf_parse_string */
     struct pdf_stats_metadata {
         int length;
         struct pdf_obj *obj;
         int success; /* if finalize succeeds */
     } meta;
 };
 

 struct pdf_stats {
     int32_t ninvalidobjs;     /* Number of invalid objects */
     int32_t njs;              /* Number of javascript objects */
     int32_t nflate;           /* Number of flate-encoded objects */
     int32_t nactivex;         /* Number of ActiveX objects */
     int32_t nflash;           /* Number of flash objects */
     int32_t ncolors;          /* Number of colors */
     int32_t nasciihexdecode;  /* Number of ASCIIHexDecode-filtered objects */
     int32_t nascii85decode;   /* Number of ASCII85Decode-filtered objects */
     int32_t nembeddedfile;    /* Number of embedded files */
     int32_t nimage;           /* Number of image objects */
     int32_t nlzw;             /* Number of LZW-filtered objects */
     int32_t nrunlengthdecode; /* Number of RunLengthDecode-filtered objects */
     int32_t nfaxdecode;       /* Number of CCITT-filtered objects */
     int32_t njbig2decode;     /* Number of JBIG2Decode-filtered objects */
     int32_t ndctdecode;       /* Number of DCTDecode-filtered objects */
     int32_t njpxdecode;       /* Number of JPXDecode-filtered objects */
     int32_t ncrypt;           /* Number of Crypt-filtered objects */
     int32_t nstandard;        /* Number of Standard-filtered objects */
     int32_t nsigned;          /* Number of Signed objects */
     int32_t nopenaction;      /* Number of OpenAction objects */
     int32_t nlaunch;          /* Number of Launch objects */
     int32_t npage;            /* Number of Page objects */

     int32_t nrichmedia;       /* Number of RichMedia objects */
     int32_t nacroform;        /* Number of AcroForm objects */
     int32_t nxfa;             /* Number of XFA objects */

     struct pdf_stats_entry *author;             /* Author of the PDF */
     struct pdf_stats_entry *creator;            /* Application used to create the PDF */
     struct pdf_stats_entry *producer;           /* Application used to produce the PDF */
     struct pdf_stats_entry *creationdate;       /* Date the PDF was created */
     struct pdf_stats_entry *modificationdate;   /* Date the PDF was modified */
     struct pdf_stats_entry *title;              /* Title of the PDF */
     struct pdf_stats_entry *subject;            /* Subject of the PDF */
     struct pdf_stats_entry *keywords;           /* Keywords of the PDF */

 };
 
 
 enum enc_method {
     ENC_UNKNOWN,
     ENC_NONE,
     ENC_IDENTITY,
     ENC_V2,
     ENC_AESV2,
     ENC_AESV3
 };
 
 struct pdf_struct {

     struct pdf_obj **objs;

     unsigned nobjs;
     unsigned flags;
     unsigned enc_method_stream;
     unsigned enc_method_string;
     unsigned enc_method_embeddedfile;
     const char *CF;
     long CF_n;
     const char *map;

     size_t size;

     off_t offset;
     off_t startoff;
     cli_ctx *ctx;
     const char *dir;
     unsigned files;
     uint32_t enc_objid;
     char *fileID;
     unsigned fileIDlen;
     char *key;
     unsigned keylen;
     struct pdf_stats stats;

     struct objstm_struct **objstms;
     uint32_t nobjstms;

 };
 

 #define OBJ_FLAG_PDFNAME_NONE 0x0
 #define OBJ_FLAG_PDFNAME_DONE 0x1
 

 #define PDF_EXTRACT_OBJ_NONE 0x0
 #define PDF_EXTRACT_OBJ_SCAN 0x1
 

 int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset);

 void pdf_parseobj(struct pdf_struct *pdf, struct pdf_obj *obj);

 int pdf_extract_obj(struct pdf_struct *pdf, struct pdf_obj *obj, uint32_t flags);

 cl_error_t pdf_findobj(struct pdf_struct *pdf);

 struct pdf_obj *find_obj(struct pdf_struct *pdf, struct pdf_obj *obj, uint32_t objid);
 

 void pdf_handle_enc(struct pdf_struct *pdf);

 char *decrypt_any(struct pdf_struct *pdf, uint32_t id, const char *in, size_t *length, enum enc_method enc_method);

 enum enc_method get_enc_method(struct pdf_struct *pdf, struct pdf_obj *obj);

 enum enc_method parse_enc_method(const char *dict, unsigned len, const char *key, enum enc_method def);

 void pdfobj_flag(struct pdf_struct *pdf, struct pdf_obj *obj, enum pdf_flag flag);

 char *pdf_finalize_string(struct pdf_struct *pdf, struct pdf_obj *obj, const char *in, size_t len);

 char *pdf_parse_string(struct pdf_struct *pdf, struct pdf_obj *obj, const char *objstart, size_t objsize, const char *str, char **endchar, struct pdf_stats_metadata *meta);
 struct pdf_array *pdf_parse_array(struct pdf_struct *pdf, struct pdf_obj *obj, size_t objsize, char *begin, char **endchar);
 struct pdf_dict *pdf_parse_dict(struct pdf_struct *pdf, struct pdf_obj *obj, size_t objsize, char *begin, char **endchar);

 int is_object_reference(char *begin, char **endchar, uint32_t *id);
 void pdf_free_dict(struct pdf_dict *dict);
 void pdf_free_array(struct pdf_array *array);

 void pdf_print_dict(struct pdf_dict *dict, unsigned long depth);
 void pdf_print_array(struct pdf_array *array, unsigned long depth);

 cl_error_t pdf_find_and_extract_objs(struct pdf_struct *pdf, uint32_t *alerts);
 cl_error_t pdf_find_and_parse_objs_in_objstm(struct pdf_struct *pdf, struct objstm_struct *objstm);
 

 #endif