#define MODULE_LOG_PREFIX "webif"

#include "globals.h"

#ifdef WEBIF
#include "cscrypt/md5.h"
#include "module-webif-lib.h"
#include "module-webif-tpl.h"
#include "oscam-config.h"
#include "oscam-files.h"
#include "oscam-lock.h"
#include "oscam-string.h"
#include "oscam-time.h"
#include "oscam-net.h"
#if defined(__linux__)
	#include <sys/sysinfo.h>
#elif defined(__APPLE__)
	#include <sys/sysctl.h>
#endif

extern int32_t ssl_active;
extern pthread_key_t getkeepalive;
extern pthread_key_t getssl;
extern CS_MUTEX_LOCK *lock_cs;
extern char noncekey[33];

static struct s_nonce *nonce_first[AUTHNONCEHASHBUCKETS];
static CS_MUTEX_LOCK nonce_lock[AUTHNONCEHASHBUCKETS];

/* Parses a value in an authentication string by removing all quotes/whitespace. Note that the original array is modified. */
static char *parse_auth_value(char *value)
{
	char *pch = value;
	char *pch2;
	value = strstr(value, "=");
	if(value != NULL)
	{
		do
		{
			++value;
		}
		while(value[0] == ' ' || value[0] == '"');
		pch = value;
		for(pch2 = value + cs_strlen(value) - 1; pch2 >= value && (pch2[0] == ' ' || pch2[0] == '"' || pch2[0] == '\r' || pch2[0] == '\n'); --pch2) { pch2[0] = '\0'; }
	}
	return pch;
}

/* Parses the date out of a "If-Modified-Since"-header. Note that the original string is modified. */
time_t parse_modifiedsince(char *value)
{
	int32_t day = -1, month = -1, year = -1, hour = -1, minutes = -1, seconds = -1;
	char months[12][4] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
	char *str, *saveptr1 = NULL;
	time_t modifiedheader = 0;
	value += 18;
	// Parse over weekday at beginning...
	while(value[0] == ' ' && value[0] != '\0') { ++value; }
	while(value[0] != ' ' && value[0] != '\0') { ++value; }
	// According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.3.1 three different timeformats are allowed so we need a bit logic to parse all of them...
	if(value[0] != '\0')
	{
		++value;
		for(month = 0; month < 12; ++month)
		{
			if(strstr(value, months[month])) { break; }
		}
		if(month > 11) { month = -1; }
		for(str = strtok_r(value, " ", &saveptr1); str; str = strtok_r(NULL, " ", &saveptr1))
		{
			switch(cs_strlen(str))
			{
			case 1:
			case 2:
				day = atoi(str);
				break;

			case 4:
				if(str[0] != 'G')
					{ year = atoi(str); }
				break;

			case 8:
				if(str[2] == ':' && str[5] == ':')
				{
					hour = atoi(str);
					minutes = atoi(str + 3);
					seconds = atoi(str + 6);
				}
				break;

			case 9:
				if(str[2] == '-' && str[6] == '-')
				{
					day = atoi(str);
					year = atoi(str + 7) + 2000;
				}
				break;
			}
		}
		if(day > 0 && day < 32 && month > 0 && year > 0 && year < 9999 && hour > -1 && hour < 24 && minutes > -1 && minutes < 60 && seconds > -1 && seconds < 60)
		{
			struct tm timeinfo;
			memset(&timeinfo, 0, sizeof(timeinfo));
			timeinfo.tm_mday = day;
			timeinfo.tm_mon = month;
			timeinfo.tm_year = year - 1900;
			timeinfo.tm_hour = hour;
			timeinfo.tm_min = minutes;
			timeinfo.tm_sec = seconds;
			modifiedheader = cs_timegm(&timeinfo);
		}
	}
	return modifiedheader;
}

/* Calculates a new opaque value. Please note that opaque needs to be at least (MD5_DIGEST_LENGTH * 2) + 1 large. */
void calculate_opaque(IN_ADDR_T addr, char *opaque)
{
	char noncetmp[128];
	uint8_t md5tmp[MD5_DIGEST_LENGTH];
	snprintf(noncetmp, sizeof(noncetmp), "%d:%s:%d", (int32_t)time(NULL), cs_inet_ntoa(addr), (int16_t)rand());
	char_to_hex(MD5((uint8_t *)noncetmp, cs_strlen(noncetmp), md5tmp), MD5_DIGEST_LENGTH, (uint8_t *)opaque);
}

void init_noncelocks(void)
{
	int32_t i;
	for(i = 0; i < AUTHNONCEHASHBUCKETS; ++i)
	{
		cs_lock_create(__func__, &nonce_lock[i], "nonce_lock", 5000);
		nonce_first[i] = NULL;
	}
}

/* Calculates the currently valid nonce value and copies it to result. Please note that nonce (may be NULL), opaque and result needs to be at least (MD5_DIGEST_LENGTH * 2) + 1 large. */
void calculate_nonce(char *nonce, char *result, char *opaque)
{
	struct s_nonce *noncelist, *prev, *foundnonce = NULL, *foundopaque = NULL, *foundexpired = NULL;
	int32_t bucket = opaque[0] % AUTHNONCEHASHBUCKETS;
	time_t now = time(NULL);
	cs_writelock(__func__, &nonce_lock[bucket]);
	for(noncelist = nonce_first[bucket], prev = NULL; noncelist; prev = noncelist, noncelist = noncelist->next)
	{
		if(now > noncelist->expirationdate)
		{
			if(prev) { prev->next = NULL; }
			else
			{
				nonce_first[bucket] = NULL;
			}
			foundexpired = noncelist;
			break;
		}
		if(nonce && !memcmp(noncelist->nonce, nonce, (MD5_DIGEST_LENGTH * 2) + 1))
		{
			memcpy(result, noncelist->nonce, (MD5_DIGEST_LENGTH * 2) + 1);
			foundnonce = noncelist;
			if(!noncelist->firstuse) { noncelist->firstuse = now; }
			else if(now - foundnonce->firstuse > AUTHNONCEVALIDSECS)
			{
				if(prev) { prev->next = noncelist->next; }
				else
				{
					nonce_first[bucket] = noncelist->next;
				}
			}
			break;
		}
		else if(!noncelist->firstuse && !memcmp(noncelist->opaque, opaque, (MD5_DIGEST_LENGTH * 2) + 1))
		{
			foundopaque = noncelist;
		}
	}
	if(foundnonce && now - foundnonce->firstuse > AUTHNONCEVALIDSECS)
	{
		NULLFREE(foundnonce);
		foundnonce = NULL;
	}
	if(!foundnonce && foundopaque)
		{ memcpy(result, foundopaque->nonce, (MD5_DIGEST_LENGTH * 2) + 1); }
	if(!foundnonce && !foundopaque)
	{
		char noncetmp[128], randstr[16];
		uint8_t md5tmp[MD5_DIGEST_LENGTH];
		get_random_bytes((uint8_t *)randstr, sizeof(randstr) - 1);
		randstr[sizeof(randstr) - 1] = '\0';
		snprintf(noncetmp, sizeof(noncetmp), "%d:%s:%s", (int32_t)now, randstr, noncekey);
		char_to_hex(MD5((uint8_t *)noncetmp, cs_strlen(noncetmp), md5tmp), MD5_DIGEST_LENGTH, (uint8_t *)result);
		if(cs_malloc(&noncelist, sizeof(struct s_nonce)))
		{
			noncelist->expirationdate = now + AUTHNONCEEXPIRATION;
			memcpy(noncelist->nonce, result, (MD5_DIGEST_LENGTH * 2) + 1);
			memcpy(noncelist->opaque, opaque, (MD5_DIGEST_LENGTH * 2) + 1);
			noncelist->next = nonce_first[bucket];
			nonce_first[bucket] = noncelist;
		}
	}
	cs_writeunlock(__func__, &nonce_lock[bucket]);
	while(foundexpired)
	{
		prev = foundexpired;
		foundexpired = foundexpired->next;
		NULLFREE(prev);
	}
}

/* Checks if authentication is correct. Returns -1 if not correct, 1 if correct and 2 if nonce isn't valid anymore.
   Note that authstring will be modified. */
int32_t check_auth(char *authstring, char *method, char *path, IN_ADDR_T addr, char *expectednonce, char *opaque)
{
	int32_t authok = 0, uriok = 0;
	char authnonce[(MD5_DIGEST_LENGTH * 2) + 1];
	memset(authnonce, 0, sizeof(authnonce));
	char *authnc = "";
	char *authcnonce = "";
	char *authresponse = "";
	char *uri = "";
	char *username = "";
	char *expectedPassword = cfg.http_pwd;
	char *pch = authstring + 22;
	char *pch2;
	char *saveptr1 = NULL;
	memset(opaque, 0, (MD5_DIGEST_LENGTH * 2) + 1);

	for(pch = strtok_r(pch, ",", &saveptr1); pch; pch = strtok_r(NULL, ",", &saveptr1))
	{
		pch2 = pch;
		while(pch2[0] == ' ' && pch2[0] != '\0') { ++pch2; }
		if(strncmp(pch2, "nonce", 5) == 0)
		{
			cs_strncpy(authnonce, parse_auth_value(pch2), sizeof(authnonce));
		}
		else if(strncmp(pch2, "nc", 2) == 0)
		{
			authnc = parse_auth_value(pch2);
		}
		else if(strncmp(pch2, "cnonce", 6) == 0)
		{
			authcnonce = parse_auth_value(pch2);
		}
		else if(strncmp(pch2, "response", 8) == 0)
		{
			authresponse = parse_auth_value(pch2);
		}
		else if(strncmp(pch2, "uri", 3) == 0)
		{
			uri = parse_auth_value(pch2);
		}
		else if(strncmp(pch2, "username", 8) == 0)
		{
			username = parse_auth_value(pch2);
		}
		else if(strncmp(pch2, "opaque", 6) == 0)
		{
			char *tmp = parse_auth_value(pch2);
			cs_strncpy(opaque, tmp, (MD5_DIGEST_LENGTH * 2) + 1);
		}
	}

	if(strncmp(uri, path, cs_strlen(path)) == 0) { uriok = 1; }
	else
	{
		pch2 = uri;
		for(pch = uri; pch[0] != '\0'; ++pch)
		{
			if(pch[0] == '/') { pch2 = pch; }
			if(strncmp(pch2, path, cs_strlen(path)) == 0) { uriok = 1; }
		}
	}
	if(uriok == 1 && streq(username, cfg.http_user))
	{
		char A1tmp[3 + cs_strlen(username) + cs_strlen(AUTHREALM) + cs_strlen(expectedPassword)];
		char A1[(MD5_DIGEST_LENGTH * 2) + 1], A2[(MD5_DIGEST_LENGTH * 2) + 1], A3[(MD5_DIGEST_LENGTH * 2) + 1];
		uint8_t md5tmp[MD5_DIGEST_LENGTH];
		snprintf(A1tmp, sizeof(A1tmp), "%s:%s:%s", username, AUTHREALM, expectedPassword);
		char_to_hex(MD5((uint8_t *)A1tmp, cs_strlen(A1tmp), md5tmp), MD5_DIGEST_LENGTH, (uint8_t *)A1);

		char A2tmp[2 + cs_strlen(method) + cs_strlen(uri)];
		snprintf(A2tmp, sizeof(A2tmp), "%s:%s", method, uri);
		char_to_hex(MD5((uint8_t *)A2tmp, cs_strlen(A2tmp), md5tmp), MD5_DIGEST_LENGTH, (uint8_t *)A2);

		char A3tmp[10 + cs_strlen(A1) + cs_strlen(A2) + cs_strlen(authnonce) + cs_strlen(authnc) + cs_strlen(authcnonce)];
		snprintf(A3tmp, sizeof(A3tmp), "%s:%s:%s:%s:auth:%s", A1, authnonce, authnc, authcnonce, A2);
		char_to_hex(MD5((uint8_t *)A3tmp, cs_strlen(A3tmp), md5tmp), MD5_DIGEST_LENGTH, (uint8_t *)A3);

		if(strcmp(A3, authresponse) == 0)
		{
			if(cs_strlen(opaque) != MD5_DIGEST_LENGTH * 2) { calculate_opaque(addr, opaque); }
			calculate_nonce(authnonce, expectednonce, opaque);
			if(strcmp(expectednonce, authnonce) == 0) { authok = 1; }
			else
			{
				authok = 2;
				cs_log_dbg(D_TRACE, "WebIf: Received stale header from %s (nonce=%s, expectednonce=%s, opaque=%s).", cs_inet_ntoa(addr), authnonce, expectednonce, opaque);
			}
		}
	}
		if(!authok)
		{	cs_log("unauthorized access from %s - invalid credentials", cs_inet_ntoa(addr)); }
	return authok;
}

int32_t webif_write_raw(char *buf, FILE *f, int32_t len)
{
	errno = 0;
#ifdef WITH_SSL
	if(ssl_active)
	{
		return SSL_write((SSL *)f, buf, len);
	}
	else
#endif
		return fwrite(buf, 1, len, f);
}

int32_t webif_write(char *buf, FILE *f)
{
	return webif_write_raw(buf, f, cs_strlen(buf));
}

int32_t webif_read(char *buf, int32_t num, FILE *f)
{
	errno = 0;
#ifdef WITH_SSL
	if(ssl_active)
	{
		return SSL_read((SSL *)f, buf, num);
	}
	else
#endif
		return read(fileno(f), buf, num);
}

void send_headers(FILE *f, int32_t status, char *title, char *extra, char *mime, int32_t cache, int32_t length, char *content, int8_t forcePlain)
{
	time_t now;
	char timebuf[32];
	char buf[sizeof(PROTOCOL) + sizeof(SERVER) + cs_strlen(title) + (extra == NULL ? 0 : cs_strlen(extra) + 2) + (mime == NULL ? 0 : cs_strlen(mime) + 2) + 350];
	char *pos = buf;
	struct tm timeinfo;

	pos += snprintf(pos, sizeof(buf) - (pos - buf), "%s %d %s\r\n", PROTOCOL, status, title);
	pos += snprintf(pos, sizeof(buf) - (pos - buf), "Server: %s\r\n", SERVER);

	now = time(NULL);
	cs_gmtime_r(&now, &timeinfo);
	strftime(timebuf, sizeof(timebuf), RFC1123FMT, &timeinfo);
	pos += snprintf(pos, sizeof(buf) - (pos - buf), "Date: %s\r\n", timebuf);

	if(extra)
		{ pos += snprintf(pos, sizeof(buf) - (pos - buf), "%s\r\n", extra); }

	if(mime)
		{ pos += snprintf(pos, sizeof(buf) - (pos - buf), "Content-Type: %s\r\n", mime); }

	if(status != 304)
	{
		if(!cache)
		{
			pos += snprintf(pos, sizeof(buf) - (pos - buf), "Cache-Control: no-store, no-cache, must-revalidate\r\n");
			pos += snprintf(pos, sizeof(buf) - (pos - buf), "Expires: Sat, 10 Jan 2000 05:00:00 GMT\r\n");
		}
		else
		{
			pos += snprintf(pos, sizeof(buf) - (pos - buf), "Cache-Control: public, max-age=7200\r\n");
		}
		pos += snprintf(pos, sizeof(buf) - (pos - buf), "Content-Length: %d\r\n", length);
		pos += snprintf(pos, sizeof(buf) - (pos - buf), "Last-Modified: %s\r\n", timebuf);
		if(content)
		{
			uint32_t checksum = (uint32_t)crc32(0L, (uint8_t *)content, length);
			pos += snprintf(pos, sizeof(buf) - (pos - buf), "ETag: \"%u\"\r\n", checksum == 0 ? 1 : checksum);
		}
	}
	if(*(int8_t *)pthread_getspecific(getkeepalive))
		{ pos += snprintf(pos, sizeof(buf) - (pos - buf), "Connection: Keep-Alive\r\n"); }
	else
		{ pos += snprintf(pos, sizeof(buf) - (pos - buf), "Connection: close\r\n"); }
	snprintf(pos, sizeof(buf) - (pos - buf), "\r\n");
	if(forcePlain == 1) { fwrite(buf, 1, cs_strlen(buf), f); }
	else { webif_write(buf, f); }
}

void send_error(FILE *f, int32_t status, char *title, char *extra, char *text, int8_t forcePlain)
{
	char buf[(2 * cs_strlen(title)) + cs_strlen(text) + 128];
	char *pos = buf;
	pos += snprintf(pos, sizeof(buf) - (pos - buf), "<HTML><HEAD><TITLE>%d %s</TITLE></HEAD>\r\n", status, title);
	pos += snprintf(pos, sizeof(buf) - (pos - buf), "<BODY><H4>%d %s</H4>\r\n", status, title);
	pos += snprintf(pos, sizeof(buf) - (pos - buf), "%s\r\n", text);
	snprintf(pos, sizeof(buf) - (pos - buf), "</BODY></HTML>\r\n");
	send_headers(f, status, title, extra, "text/html", 0, cs_strlen(buf), NULL, forcePlain);
	if(forcePlain == 1) { fwrite(buf, 1, cs_strlen(buf), f); }
	else { webif_write(buf, f); }
}

void send_error500(FILE *f)
{
	send_error(f, 500, "Internal Server Error", NULL, "The server encountered an internal error that prevented it from fulfilling this request.", 0);
}

void send_header304(FILE *f, char *extraheader)
{
	send_headers(f, 304, "Not Modified", extraheader, NULL, 1, 0, NULL, 0);
}

/*
 * function for sending files.
 */
void send_file(FILE *f, char *filename, char *subdir, time_t modifiedheader, uint32_t etagheader, char *extraheader)
{
	int8_t filen = 0;
	int32_t size = 0;
	char *mimetype = "";
	char *result = " ";
	char *allocated = NULL;
	time_t moddate;
	char path[255];
	char *CSS = NULL;
	char *JSCRIPT = NULL;
	char *JQUERY = NULL;

	if(!strcmp(filename, "CSS"))
	{
		filename = cfg.http_css ? cfg.http_css : "";
		if(subdir && cs_strlen(subdir) > 0)
		{
			filename = tpl_getFilePathInSubdir(cfg.http_tpl ? cfg.http_tpl : "", subdir, "site", ".css", path, 255);
		}
		mimetype = "text/css";
		filen = 1;
	}
	else if(!strcmp(filename, "JS"))
	{
		filename = cfg.http_jscript ? cfg.http_jscript : "";
		if(subdir && cs_strlen(subdir) > 0)
		{
			filename = tpl_getFilePathInSubdir(cfg.http_tpl ? cfg.http_tpl : "", subdir, "oscam", ".js", path, 255);
		}
		mimetype = "text/javascript";
		filen = 2;
	}
	else if(!strcmp(filename, "JQ"))
	{
		if(subdir && cs_strlen(subdir) > 0)
		{
			filename = tpl_getFilePathInSubdir(cfg.http_tpl ? cfg.http_tpl : "", subdir, "jquery", ".js", path, 255);
		}
		mimetype = "text/javascript";
		filen = 3;
	}

	if(cs_strlen(filename) > 0 && file_exists(filename))
	{
		struct stat st;
		FILE *fp = NULL;
		int32_t readen = 0;
		uint32_t CSS_sz = 0;
		char separator[255];

		stat(filename, &st);
		moddate = st.st_mtime;
		memset(separator, 0, sizeof(separator));

		if(filen == 1 && cfg.http_prepend_embedded_css)    // Prepend Embedded CSS
		{
			CSS = tpl_getUnparsedTpl("CSS", 1, "");
			snprintf(separator, sizeof(separator), "\n/* Begin embedded CSS File: %s */\n", cfg.http_css);
		}

		// We need at least size 1 or keepalive gets problems on some browsers...
		if(st.st_size > 0)
		{
			if((fp = fopen(filename, "r")) == NULL)
				return;

			if (CSS)
				CSS_sz += cs_strlen(CSS);

			if(!cs_malloc(&allocated, st.st_size + CSS_sz + cs_strlen(separator) + 1))
			{
				send_error500(f);
				fclose(fp);
				return;
			}

			if((readen = fread(allocated + CSS_sz + cs_strlen(separator), 1, st.st_size, fp)) == st.st_size)
			{
				allocated[readen + CSS_sz + cs_strlen(separator)] = '\0';
			}

			fclose(fp);
		}

		if(filen == 1 && cfg.http_prepend_embedded_css)    // Prepend Embedded CSS
		{
			if (CSS && allocated)
			{
				memcpy(allocated, CSS, CSS_sz);
				memcpy(allocated + CSS_sz, separator, cs_strlen(separator));
				allocated[readen + CSS_sz + cs_strlen(separator)] = '\0';
			}
		}

		if(allocated) { result = allocated; }
	}
	else
	{
		CSS = tpl_getUnparsedTpl("CSS", 1, "");
		JSCRIPT = tpl_getUnparsedTpl("JSCRIPT", 1, "");
		JQUERY = tpl_getUnparsedTpl("JQUERY", 1, "");
		if(filen == 1 && cs_strlen(CSS) > 0){ result = CSS;}
		else if(filen == 2 && cs_strlen(JSCRIPT) > 0){result = JSCRIPT;}
		else if(filen == 3 && cs_strlen(JQUERY) > 0){result = JQUERY;}
		moddate = first_client->login;
	}

	size = cs_strlen(result);

	if((etagheader == 0 && moddate < modifiedheader) || (etagheader > 0 && (uint32_t)crc32(0L, (uint8_t *)result, size) == etagheader))
	{
		send_header304(f, extraheader);
	}
	else
	{
		send_headers(f, 200, "OK", NULL, mimetype, 1, size, result, 0);
		webif_write(result, f);
	}
	if(allocated) { NULLFREE(allocated); }
	NULLFREE(CSS);
	NULLFREE(JSCRIPT);
	NULLFREE(JQUERY);
}

/* Parse url parameters and save them to params array. The pch pointer is increased to the position where parsing stopped. */
void parseParams(struct uriparams *params, char *pch)
{
	char *pch2;
	// parsemode = 1 means parsing next param, parsemode = -1 parsing next
	//value; pch2 points to the beginning of the currently parsed string, pch is the current position
	int32_t parsemode = 1;

	pch2 = pch;
	while(pch[0] != '\0')
	{
		if((parsemode == 1 && pch[0] == '=') || (parsemode == -1 && pch[0] == '&'))
		{
			pch[0] = '\0';
			urldecode(pch2);
			if(parsemode == 1)
			{
				if(params->paramcount >= MAXGETPARAMS) { break; }
				++params->paramcount;
				params->params[params->paramcount - 1] = pch2;
			}
			else
			{
				params->values[params->paramcount - 1] = pch2;
			}
			parsemode = -parsemode;
			pch2 = pch + 1;
		}
		++pch;
	}
	/* last value wasn't processed in the loop yet... */
	if(parsemode == -1 && params->paramcount <= MAXGETPARAMS)
	{
		urldecode(pch2);
		params->values[params->paramcount - 1] = pch2;
	}
}

/* Returns the value of the parameter called name or an empty string if it doesn't exist. */
char *getParam(struct uriparams *params, char *name)
{
	int32_t i;
	for(i = (*params).paramcount - 1; i >= 0; --i)
	{
		if(strcmp((*params).params[i], name) == 0) { return (*params).values[i]; }
	}
	return "";
}

/*
 * returns uptime in sec on success, -1 on error
*/
int32_t oscam_get_uptime(void)
{
#if defined(__linux__)
	struct sysinfo uptime;
	if(!sysinfo(&uptime)){
		return (int32_t)uptime.uptime;
	}
	else{
		return -1;
	}
#elif defined(__APPLE__)
	struct timeval boottime;
	size_t len = sizeof(boottime);
	int mib[2] = { CTL_KERN, KERN_BOOTTIME };
	if(sysctl(mib, 2, &boottime, &len, NULL, 0) < 0 ){
		return -1;
	}
	time_t bsec = boottime.tv_sec, csec = time(NULL);

	return difftime(csec, bsec);
#else
	return -1;
#endif
}

#if defined(__linux__)
/*
 * read /proc data into the passed struct pstat
 * returns 0 on success, -1 on error
*/
int8_t get_stats_linux(const pid_t pid, struct pstat* result)
{
	// convert pid to string
	char pid_s[20];
	snprintf(pid_s, sizeof(pid_s), "%d", pid);
	char stat_filepath[30] = "/proc/";

	if (!cs_strncat(stat_filepath, pid_s, sizeof(stat_filepath))) {
		return -1;
	}

	if (!cs_strncat(stat_filepath, "/stat", sizeof(stat_filepath))) {
		return -1;
	}

	FILE *f_pstat = fopen(stat_filepath, "r");
	if (f_pstat == NULL) {
		cs_log("FOPEN ERROR %s",stat_filepath);
		return -1;
	}

	FILE *f_stat = fopen("/proc/stat", "r");
	if (!f_stat) {
		fclose(f_pstat);
		cs_log("ERROR: Can't open /proc/stat for reading: %s", strerror(errno));
		return -1;
	}

	// read values from /proc/pid/stat
	uint64_t rss;
	if (fscanf(f_pstat, "%*d %*s %*c %*d %*d %*d %*d %*d %*u %*u %*u %*u %*u %" SCNd64
				"%" SCNd64 "%" SCNd64 "%" SCNd64 "%*d %*d %*d %*d %*u %" SCNu64 "%" SCNu64,
				&result->utime_ticks,&result->stime_ticks,
				&result->cutime_ticks,&result->cstime_ticks,&result->vsize,
				&rss) == EOF)
	{
		fclose(f_pstat);
		fclose(f_stat);
		return -1;
	}
	fclose(f_pstat);
	result->rss = rss * getpagesize();

	// read+calc cpu total time from /proc/stat
	int64_t cpu_time[10] = {0,0,0,0,0,0,0,0,0,0};
	if (fscanf(f_stat, "%*s %" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64 "%" SCNd64,
				&cpu_time[0], &cpu_time[1], &cpu_time[2], &cpu_time[3],
				&cpu_time[4], &cpu_time[5], &cpu_time[6], &cpu_time[7],
				&cpu_time[8], &cpu_time[9]) == EOF)
	{
		fclose(f_stat);
		return -1;
	}
	fclose(f_stat);
	int8_t i;
	result->cpu_total_time = 0;
	// FIXME: On 32 Bit platforms, the single cpu times can overflow quite easily (clock_t from /proc/stat normally refers to a int32 here) resulting in useless calculation results!
	for(i = 0; i < 10; i++) {
		result->cpu_total_time += cpu_time[i];
	}

	// read cached from /proc/meminfo
	uint64_t meminfo_cached = 0;
	FILE *fd = fopen("/proc/meminfo", "r");
	if (fd ) {
		char line[256];
		while(fgets(line, sizeof(line), fd)) {
			if(sscanf(line, "Cached: %" PRId64" \n kB", &meminfo_cached) == 1){
				break;
			}
		}
		fclose(fd);
	}

	// read processes from /proc
	uint info_procs = 0;
	struct dirent **entries;
	int n = scandir("/proc", &entries, NULL, NULL);
	n = MAX(n, 0);
	while(n--)
	{
		if (entries[n]->d_name[0] > '0' && entries[n]->d_name[0] <= '9') { info_procs++; }
		free(entries[n]);
	}
	free(entries);

	// read cpu/meminfo from sysinfo()
	struct sysinfo info;
	float shiftfloat = (float)(1 << SI_LOAD_SHIFT);
	if (!sysinfo(&info)) {
		// processes
		result->info_procs = info_procs;
		// cpu load
		result->cpu_avg[0] = (float) info.loads[0] / shiftfloat;
		result->cpu_avg[1] = (float) info.loads[1] / shiftfloat;
		result->cpu_avg[2] = (float) info.loads[2] / shiftfloat;
		// meminfo
		result->mem_total = info.totalram  * info.mem_unit;
		result->mem_free = info.freeram * info.mem_unit;
		result->mem_used = result->mem_total - result->mem_free;
		result->mem_buff = info.bufferram * info.mem_unit;
		result->mem_cached = meminfo_cached * 1024;
		result->mem_freem = result->mem_free + result->mem_buff + result->mem_cached;
		result->mem_share = info.sharedram * info.mem_unit;
		result->mem_total_swap = info.totalswap * info.mem_unit;
		result->mem_free_swap = info.freeswap * info.mem_unit;
		result->mem_used_swap = result->mem_total_swap - result->mem_free_swap;
	}

	// set timestamp for function call
	cs_ftime(&result->time_started);

	return 0;
}

/*
* calculates the elapsed CPU usage between 2 measuring points. in percent and stores to cur_usage
*/
void calc_cpu_usage_pct(struct pstat* cur_usage, struct pstat* last_usage)
{
	const double total_time_diff = cur_usage->cpu_total_time - last_usage->cpu_total_time;

	//time difference between cur_usage/last_usage when created / in sec
	cur_usage->gone_refresh = comp_timeb(&cur_usage->time_started, &last_usage->time_started)/1000;

	if(cur_usage->gone_refresh < 1){
		//set to N/A since result may provide wrong results (/proc not updated)
		cur_usage->check_available |= (1 << 9);
		cur_usage->check_available |= (1 << 10);
		cur_usage->check_available |= (1 << 11);
	}
	else{
		int64_t cur_ticks = cur_usage->utime_ticks + cur_usage->cutime_ticks;
		int64_t last_ticks = last_usage->utime_ticks + last_usage->cutime_ticks;
		//reset flags if set bevore
		cur_usage->check_available &= ~(1 << 9);
		cur_usage->check_available &= ~(1 << 10);
		cur_usage->check_available &= ~(1 << 11);

		cur_usage->cpu_usage_user = 100.0 * llabs(cur_ticks - last_ticks) / total_time_diff;

		cur_ticks = cur_usage->stime_ticks + cur_usage->cstime_ticks;
		last_ticks = last_usage->stime_ticks + last_usage->cstime_ticks;

		cur_usage->cpu_usage_sys = 100.0 * llabs(cur_ticks - last_ticks) / total_time_diff;
	}
}
#endif

#ifdef WITH_SSL
SSL *cur_ssl(void)
{
	return (SSL *) pthread_getspecific(getssl);
}

/* Locking functions for SSL multithreading */
struct CRYPTO_dynlock_value
{
	pthread_mutex_t mutex;
};

/* function really needs unsigned long to prevent compiler warnings... */
unsigned long SSL_id_function(void)
{
	return ((unsigned long) pthread_self());
}

void SSL_locking_function(int32_t mode, int32_t type, const char *file, int32_t line)
{
	if(mode & CRYPTO_LOCK)
	{
		cs_writelock(__func__, &lock_cs[type]);
	}
	else
	{
		cs_writeunlock(__func__, &lock_cs[type]);
	}
	// just to remove compiler warnings...
	if(file || line) { return; }
}

struct CRYPTO_dynlock_value *SSL_dyn_create_function(const char *file, int32_t line)
{
	struct CRYPTO_dynlock_value *l;
	if(!cs_malloc(&l, sizeof(struct CRYPTO_dynlock_value)))
		{ return NULL; }

	if(pthread_mutex_init(&l->mutex, NULL))
	{
		// Initialization of mutex failed.
		NULLFREE(l);
		return (NULL);
	}

	// just to remove compiler warnings...
	if(file || line) { return l; }
	return l;
}

void SSL_dyn_lock_function(int32_t mode, struct CRYPTO_dynlock_value *l, const char *file, int32_t line)
{
	if(mode & CRYPTO_LOCK)
	{
		SAFE_MUTEX_LOCK(&l->mutex);
	}
	else
	{
		SAFE_MUTEX_UNLOCK(&l->mutex);
	}
	// just to remove compiler warnings...
	if(file || line) { return; }
}

void SSL_dyn_destroy_function(struct CRYPTO_dynlock_value *l, const char *file, int32_t line)
{
	pthread_mutex_destroy(&l->mutex);
	NULLFREE(l);
	// just to remove compiler warnings...
	if(file || line) { return; }
}

#if defined(OPENSSL_NO_EC)
#pragma message "WARNING: OpenSSL was built without support for elliptic curve cryptography (no-ec). Webserver certificate generation at runtime will not work!"
static bool create_certificate(const char *path)
{
	cs_log("generating webserver ssl certificate file %s (%s)", path, "SKIPPED");
	return false;
}
#else
/* add X.509 V3 extensions */
static bool add_ext(X509 *cert, int nid, char *value)
{
	X509_EXTENSION *ex;
	X509V3_CTX ctx;

	X509V3_set_ctx_nodb(&ctx);
	X509V3_set_ctx(&ctx, cert, cert, NULL, NULL, 0);
	ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, value);
	if (!ex)
		return false;

	X509_add_ext(cert, ex, -1);
	X509_EXTENSION_free(ex);
	return true;
}

/* Create a self-signed certificate for basic https webif usage */
static bool create_certificate(const char *path)
{
	X509 *pcert = NULL;
	X509_NAME * subject_name;
	X509_NAME * issuer_name;
	EVP_PKEY *pkey = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	RSA * rsa_key = NULL;
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
	EC_KEY *ec_key = NULL;
#endif
	ASN1_INTEGER *asn1_serial_number;
	BIGNUM *serial_number = NULL;
	char san[256];
	struct utsname buffer;
	bool ret = false;

	const char *cn = !uname(&buffer) ? buffer.nodename : "localhost";
	size_t cn_len = MIN(strlen(cn), 63);

	cs_log("generating webserver ssl certificate file %s (%s)", path,
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	"RSA"
#else
	"ECDSA"
#endif
	);
	if ((pkey = EVP_PKEY_new()))
	{
#if OPENSSL_VERSION_NUMBER < 0x10100000L
		if (!(rsa_key = RSA_generate_key(4096, RSA_F4, NULL, NULL)))
		{
			goto err;
		}
		if (!EVP_PKEY_assign_RSA(pkey, rsa_key))
		{
			goto err;
		}
		rsa_key = NULL;
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
		if (!(ec_key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1))) //prime256v1
		{
			goto err;
		}
		if (!EC_KEY_generate_key(ec_key))
		{
			goto err;
		}
		if (!EVP_PKEY_assign_EC_KEY(pkey, ec_key))
		{
			goto err;
		}
		ec_key = NULL;
#else
		pkey = EVP_EC_gen(SN_X9_62_prime256v1); //prime256v1
#endif
		if ((pcert = X509_new()))
		{
			X509_set_pubkey(pcert, pkey);
			// serialNumber
			if (!X509_set_version(pcert, 2L))
			{
				goto err;
			}

			// serialNumber
			if ((serial_number = BN_new()))
			{
#if OPENSSL_VERSION_NUMBER < 0x10100000L
				if (!BN_pseudo_rand(serial_number, 64, 0, 0))
				{
					goto err;
				}
#else
				if (!BN_rand(serial_number, 64, 0, 0))
				{
					goto err;
				}
#endif
				asn1_serial_number = X509_get_serialNumber(pcert);
				if (!asn1_serial_number)
				{
					goto err;
				}
				if (!BN_to_ASN1_INTEGER(serial_number, asn1_serial_number))
				{
					goto err;
				}

				// subject + issuer
				if ((subject_name = X509_NAME_new()) && (issuer_name = X509_NAME_new()))
				{
					if (!X509_NAME_add_entry_by_NID(subject_name, NID_commonName, MBSTRING_UTF8, (unsigned char *) cn, cn_len, -1, 0))
					{
						goto err;
					}
					if (!X509_set_subject_name(pcert, subject_name))
					{
						goto err;
					}

					if (!X509_NAME_add_entry_by_NID(issuer_name, NID_commonName, MBSTRING_UTF8, (unsigned char *) cn, cn_len, -1, 0))
					{
						goto err;
					}
					if (!X509_set_issuer_name(pcert, issuer_name))
					{
						goto err;
					}

					// expiration
					X509_gmtime_adj(X509_getm_notBefore(pcert), 0);
					X509_gmtime_adj(X509_getm_notAfter(pcert), CERT_EXPIRY_TIME);

					// X.509 V3 extensions
					add_ext(pcert, NID_basic_constraints, "CA:FALSE" );
					add_ext(pcert, NID_key_usage, "nonRepudiation, digitalSignature, keyEncipherment" );
					add_ext(pcert, NID_ext_key_usage, "clientAuth, serverAuth" );
					snprintf(san, sizeof(san), "DNS:%s, DNS:%s.local, IP:127.0.0.1, IP:::1", cn, cn);
					add_ext(pcert, NID_subject_alt_name, san);

					// sign certificate with private key
					X509_sign(pcert, pkey, EVP_sha256());

					// write private key and certificate to file
					FILE * pemfile;
					if ((pemfile = fopen(path, "w")))
					{
						PEM_write_PrivateKey(pemfile, pkey, NULL, NULL, 0, NULL, NULL);
						PEM_write_X509(pemfile, pcert);
						fclose(pemfile);
						ret = true;
					}
					else
					{
						cs_log("can't write to file %s", path);
						goto err;
					}
				}
				else
				{
					cs_log("Error: X509_NAME_new() failed");
				}
			}
			else
			{
				cs_log("Error: BN_new() failed");
			}
		}
		else
		{
			cs_log("Error: X509_new() failed");
		}
	}
	else
	{
		cs_log("Error: EVP_PKEY_new() failed");
	}

err:
	ERR_print_errors_fp(stderr);
	if (pkey)
	{
		EVP_PKEY_free(pkey);
	}
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L
	if (ec_key)
	{
		EC_KEY_free(ec_key);
	}
#endif
	if (pcert)
	{
		X509_free(pcert);
	}
	if (serial_number)
	{
		BN_free(serial_number);
	}

	return ret;
}
#endif

/* Init necessary structures for SSL in WebIf*/
SSL_CTX *SSL_Webif_Init(void)
{
	SSL_CTX *ctx;

	static const char *cs_cert = "oscam.pem";

	// set locking callbacks for SSL
	int32_t i, num = CRYPTO_num_locks();
	lock_cs = (CS_MUTEX_LOCK *) OPENSSL_malloc(num * sizeof(CS_MUTEX_LOCK));

	for(i = 0; i < num; ++i)
	{
		cs_lock_create(__func__, &lock_cs[i], "ssl_lock_cs", 10000);
	}
	/* static lock callbacks */
	CRYPTO_set_id_callback(SSL_id_function);
	CRYPTO_set_locking_callback(SSL_locking_function);
	/* dynamic lock callbacks */
	CRYPTO_set_dynlock_create_callback(SSL_dyn_create_function);
	CRYPTO_set_dynlock_lock_callback(SSL_dyn_lock_function);
	CRYPTO_set_dynlock_destroy_callback(SSL_dyn_destroy_function);

	ctx = SSL_CTX_new(SSLv23_server_method());

#if defined(SSL_CTX_set_ecdh_auto)
		(void) SSL_CTX_set_ecdh_auto(ctx, 1);
#elif defined(EC_PKEY_NO_PARAMETERS) && defined(NID_X9_62_prime256v1)
		EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
		if(ecdh)
		{
			SSL_CTX_set_tmp_ecdh(ctx, ecdh);
			EC_KEY_free(ecdh);
		}
#endif

	if(cfg.https_force_secure_mode)
	{
#if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined SSL_CTX_clear_options // makro removed in OpenSSL 1.1.0+
		SSL_CTX_clear_options(ctx, SSL_OP_ALL); //we CLEAR all bug workarounds! This is for security reason
#else
		cs_log("WARNING: You enabled to force secure HTTPS but your system does not support to clear the ssl workarounds! SSL security will be reduced!");
#endif
	}

#if OPENSSL_VERSION_NUMBER >= 0x10100000L
	SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
#elif defined SSL_OP_NO_TLSv1_1
	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1);
#else
	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
#endif

	char path[128];

	if(!cfg.http_cert)
		{ get_config_filename(path, sizeof(path), cs_cert); }
	else
		{ cs_strncpy(path, cfg.http_cert, sizeof(path)); }

	if(!file_exists(path) && cfg.https_auto_create_cert) //generate a ready-to-use SSL certificate if no certificate file is available
	{
		if(!create_certificate(path))
		{
			goto out_err;
		}
	}

	if(!ctx)
		goto out_err;

	if(SSL_CTX_use_certificate_chain_file(ctx, path) <=0)
		goto out_err;

	if(SSL_CTX_use_PrivateKey_file(ctx, path, SSL_FILETYPE_PEM) <= 0)
		goto out_err;

	if(!SSL_CTX_check_private_key(ctx))
	{
		cs_log("SSL: Private key does not match the certificate public key");
		goto out_err;
	}

	cs_log("loading ssl certificate file %s", path);
	return ctx;

out_err:
	ERR_print_errors_fp(stderr);
#if OPENSSL_VERSION_NUMBER < 0x1010005fL
    // fix build "OpenSSL 1.1.0e  16 Feb 2017"
	ERR_remove_state(0);
#endif
	SSL_CTX_free(ctx);
	return NULL;
}
#endif

#endif