/*
 * Copyright 2025 Vsevolod Stakhov
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "config.h"
#include "libserver/dynamic_cfg.h"
#include "libserver/cfg_file_private.h"
#include "libutil/rrd.h"
#include "libutil/hash.h"
#include "libserver/maps/map.h"
#include "libserver/maps/map_helpers.h"
#include "libserver/maps/map_private.h"
#include "libserver/http/http_private.h"
#include "libserver/http/http_router.h"
#include "libstat/stat_api.h"
#include "rspamd.h"
#include "libserver/worker_util.h"
#include "libserver/ssl_util.h"
#include "worker_private.h"
#include "lua/lua_common.h"
#include "cryptobox.h"
#include "ottery.h"
#include "fuzzy_wire.h"
#include "unix-std.h"
#include "utlist.h"
#include "libmime/lang_detection.h"
#include "mempool_vars_internal.h"
#include "lua/lua_classnames.h"
#include <math.h>

/* 60 seconds for worker's IO */
#define DEFAULT_WORKER_IO_TIMEOUT 60000

/*
 * Authentication failures allowed from a single source before it is throttled,
 * and the time it takes for a full bucket to drain again.
 */
#define DEFAULT_MAX_AUTH_FAILURES 10
#define DEFAULT_AUTH_FAILURE_WINDOW 60.0
/* Bounds the memory used by the throttling state */
#define AUTH_FAILURES_CACHE_SIZE 1024

/*
 * Admission control limits, both disabled by default so that this release
 * behaves exactly as the previous ones unless an operator opts in.
 */
#define DEFAULT_MAX_CONNECTIONS 0
#define DEFAULT_MAX_CONNECTIONS_PER_SOURCE 0

/* HTTP paths */
#define PATH_AUTH "/auth"
#define PATH_SYMBOLS "/symbols"
#define PATH_ACTIONS "/actions"
#define PATH_MAPS "/maps"
#define PATH_GET_MAP "/getmap"
#define PATH_GRAPH "/graph"
#define PATH_PIE_CHART "/pie"
#define PATH_HEALTHY "/healthy"
#define PATH_HISTORY "/history"
#define PATH_HISTORY_RESET "/historyreset"
#define PATH_LEARN_SPAM "/learnspam"
#define PATH_LEARN_HAM "/learnham"
#define PATH_LEARN_CLASS "/learnclass"
#define PATH_METRICS "/metrics"
#define PATH_READY "/ready"
#define PATH_SAVE_ACTIONS "/saveactions"
#define PATH_SAVE_SYMBOLS "/savesymbols"
#define PATH_SAVE_MAP "/savemap"
#define PATH_SCAN "/scan"
#define PATH_CHECK "/check"
#define PATH_CHECKV2 "/checkv2"
#define PATH_CHECKV3 "/checkv3"
#define PATH_STAT "/stat"
#define PATH_STAT_RESET "/statreset"
#define PATH_COUNTERS "/counters"
#define PATH_ERRORS "/errors"
#define PATH_NEIGHBOURS "/neighbours"
#define PATH_PLUGINS "/plugins"
#define PATH_PING "/ping"
#define PATH_BAYES_CLASSIFIERS "/bayes/classifiers"

#define msg_err_session(...) rspamd_default_log_function(G_LOG_LEVEL_CRITICAL,                               \
														 session->pool->tag.tagname, session->pool->tag.uid, \
														 RSPAMD_LOG_FUNC,                                    \
														 __VA_ARGS__)
#define msg_warn_session(...) rspamd_default_log_function(G_LOG_LEVEL_WARNING,                                \
														  session->pool->tag.tagname, session->pool->tag.uid, \
														  RSPAMD_LOG_FUNC,                                    \
														  __VA_ARGS__)
#define msg_info_session(...) rspamd_default_log_function(G_LOG_LEVEL_INFO,                                   \
														  session->pool->tag.tagname, session->pool->tag.uid, \
														  RSPAMD_LOG_FUNC,                                    \
														  __VA_ARGS__)
#define msg_err_ctx(...) rspamd_default_log_function(G_LOG_LEVEL_CRITICAL,                      \
													 "controller", ctx->cfg->cfg_pool->tag.uid, \
													 RSPAMD_LOG_FUNC,                           \
													 __VA_ARGS__)
#define msg_warn_ctx(...) rspamd_default_log_function(G_LOG_LEVEL_WARNING,                       \
													  "controller", ctx->cfg->cfg_pool->tag.uid, \
													  RSPAMD_LOG_FUNC,                           \
													  __VA_ARGS__)
#define msg_info_ctx(...) rspamd_default_log_function(G_LOG_LEVEL_INFO,                          \
													  "controller", ctx->cfg->cfg_pool->tag.uid, \
													  RSPAMD_LOG_FUNC,                           \
													  __VA_ARGS__)

#define msg_debug_session(...) rspamd_conditional_debug_fast(NULL, session->from_addr,                                       \
															 rspamd_controller_log_id, "controller", session->pool->tag.uid, \
															 RSPAMD_LOG_FUNC,                                                \
															 __VA_ARGS__)

INIT_LOG_MODULE(controller)

/* Graph colors */
#define COLOR_CLEAN "#58A458"
#define COLOR_PROBABLE_SPAM "#D67E7E"
#define COLOR_GREYLIST "#A0A0A0"
#define COLOR_REJECT "#CB4B4B"
#define COLOR_TOTAL "#9440ED"

static const uint64_t rspamd_controller_ctx_magic = 0xf72697805e6941faULL;

extern void fuzzy_stat_command(struct rspamd_task *task);

gpointer init_controller_worker(struct rspamd_config *cfg);
void start_controller_worker(struct rspamd_worker *worker);

worker_t controller_worker = {
	"controller",            /* Name */
	init_controller_worker,  /* Init function */
	start_controller_worker, /* Start function */
	RSPAMD_WORKER_HAS_SOCKET | RSPAMD_WORKER_KILLABLE |
		RSPAMD_WORKER_SCANNER | RSPAMD_WORKER_CONTROLLER,
	RSPAMD_WORKER_SOCKET_TCP, /* TCP socket */
	RSPAMD_WORKER_VER         /* Version info */
};
/*
 * Worker's context
 */
struct rspamd_controller_worker_ctx {
	uint64_t magic;
	/* Events base */
	struct ev_loop *event_loop;
	/* DNS resolver */
	struct rspamd_dns_resolver *resolver;
	/* Config */
	struct rspamd_config *cfg;
	/* END OF COMMON PART */
	ev_tstamp timeout;
	/* Webui password */
	char *password;
	/* Privileged password */
	char *enable_password;
	/* Cached versions of the passwords */
	rspamd_ftok_t cached_password;
	rspamd_ftok_t cached_enable_password;
	/*
	 * Leaky buckets of failed authentication attempts, keyed by source address.
	 * Password verification runs a deliberately expensive KDF in this worker's
	 * event loop, so unauthenticated attempts must be bounded per source.
	 */
	rspamd_lru_hash_t *auth_failures;
	unsigned int max_auth_failures;
	double auth_failure_window;
	/*
	 * Admission control. Both limits are disabled (0) by default to preserve
	 * the historical behaviour; `conns_per_source` counts the connections that
	 * are currently being served, keyed by peer address.
	 */
	unsigned int max_connections;
	unsigned int max_connections_per_source;
	GHashTable *conns_per_source;
	/*
	 * Whether TCP clients of this worker may use the privileged File/Path/Shm
	 * message source inputs. Unix socket peers always may.
	 */
	gboolean allow_file_and_shm_inputs;
	/* HTTP server */
	struct rspamd_http_context *http_ctx;
	struct rspamd_http_connection_router *http;
	/* Main server */
	struct rspamd_main *srv;
	/* SSL cert */
	char *ssl_cert;
	/* SSL private key */
	char *ssl_key;
	/* A map of secure IP */
	const ucl_object_t *secure_ip;
	struct rspamd_radix_map_helper *secure_map;

	/* Static files dir */
	char *static_files_dir;

	/* Custom commands registered by plugins */
	GHashTable *custom_commands;

	/* Plugins registered from lua */
	GHashTable *plugins;

	/* Worker */
	struct rspamd_worker *worker;

	/* Local keypair */
	gpointer key;

	struct rspamd_rrd_file *rrd;
	struct rspamd_lang_detector *lang_det;
	double task_timeout;

	/* Health check stuff */
	unsigned int workers_count;
	unsigned int scanners_count;
	unsigned int workers_hb_lost;
	ev_timer health_check_timer;
};

struct rspamd_controller_plugin_cbdata {
	lua_State *L;
	struct rspamd_controller_worker_ctx *ctx;
	char *plugin;
	struct ucl_lua_funcdata *handler;
	ucl_object_t *obj;
	gboolean is_enable;
	gboolean need_task;
	unsigned int version;
};

static gboolean
rspamd_is_encrypted_password(const char *password,
							 struct rspamd_controller_pbkdf const **pbkdf)
{
	const char *start, *end;
	int64_t id;
	gsize size, i;
	gboolean ret = FALSE;
	const struct rspamd_controller_pbkdf *p;

	if (password[0] == '$') {
		/* Parse id */
		start = password + 1;
		end = start;
		size = 0;

		while (*end != '\0' && g_ascii_isdigit(*end)) {
			size++;
			end++;
		}

		if (size > 0) {
			char *endptr;
			id = strtoul(start, &endptr, 10);

			if ((endptr == NULL || *endptr == *end)) {
				for (i = 0; i < RSPAMD_PBKDF_ID_MAX - 1; i++) {
					p = &pbkdf_list[i];

					if (p->id == id) {
						ret = TRUE;
						if (pbkdf != NULL) {
							*pbkdf = &pbkdf_list[i];
						}

						break;
					}
				}
			}
		}
	}

	return ret;
}

static const char *
rspamd_encrypted_password_get_str(const char *password, gsize pwlen, gsize skip,
								  gsize *length)
{
	const char *str, *start, *end;
	gsize size;

	if (skip >= pwlen) {
		/* Malformed hash: this component is missing entirely */
		return NULL;
	}

	start = password + skip;
	end = start;
	size = 0;

	while (*end != '\0' && g_ascii_isalnum(*end)) {
		size++;
		end++;
	}

	if (size) {
		str = start;
		*length = size;
	}
	else {
		str = NULL;
	}

	return str;
}

static gboolean
rspamd_check_encrypted_password(struct rspamd_controller_worker_ctx *ctx,
								const rspamd_ftok_t *password, const char *check,
								const struct rspamd_controller_pbkdf *pbkdf,
								gboolean is_enable)
{
	const char *salt, *hash;
	char *salt_decoded, *key_decoded;
	gsize pwlen, salt_len = 0, key_len = 0;
	/*
	 * Authentication must fail closed: `ret` is only ever set to TRUE after a
	 * complete KDF comparison has succeeded below.
	 */
	gboolean ret = FALSE;
	unsigned char *local_key;
	rspamd_ftok_t *cache;
	gpointer m;

	/* First of all check cached versions to save resources */
	if (is_enable && ctx->cached_enable_password.len != 0) {
		if (password->len != ctx->cached_enable_password.len ||
			!rspamd_constant_memcmp(password->begin,
									ctx->cached_enable_password.begin, password->len)) {
			msg_info_ctx("incorrect or absent enable password has been specified");
			return FALSE;
		}

		return TRUE;
	}
	else if (!is_enable && ctx->cached_password.len != 0) {
		if (password->len != ctx->cached_password.len ||
			!rspamd_constant_memcmp(password->begin,
									ctx->cached_password.begin, password->len)) {
			/* We still need to check enable password here */
			if (ctx->cached_enable_password.len != 0) {
				if (password->len != ctx->cached_enable_password.len ||
					!rspamd_constant_memcmp(password->begin,
											ctx->cached_enable_password.begin,
											password->len)) {
					msg_info_ctx(
						"incorrect or absent password has been specified");

					return FALSE;
				}
				else {
					/* Cached matched */
					return TRUE;
				}
			}
			else {
				/* We might want to check uncached version */
				goto check_uncached;
			}
		}
		else {
			/* Cached matched */
			return TRUE;
		}
	}

check_uncached:
	g_assert(pbkdf != NULL);
	pwlen = strlen(check);
	/* get salt */
	salt = rspamd_encrypted_password_get_str(check, pwlen, 3, &salt_len);
	/* get hash */
	hash = rspamd_encrypted_password_get_str(check, pwlen, 3 + salt_len + 1,
											 &key_len);
	if (salt != NULL && hash != NULL) {

		/* decode salt */
		salt_decoded = rspamd_decode_base32(salt, salt_len, &salt_len, RSPAMD_BASE32_DEFAULT);

		if (salt_decoded == NULL || salt_len != pbkdf->salt_len) {
			/* We have some unknown salt here */
			msg_info_ctx("incorrect salt: %z, while %z expected",
						 salt_len, pbkdf->salt_len);
			g_free(salt_decoded);

			return FALSE;
		}

		key_decoded = rspamd_decode_base32(hash, key_len, &key_len, RSPAMD_BASE32_DEFAULT);

		if (key_decoded == NULL || key_len != pbkdf->key_len) {
			/* We have some unknown salt here */
			msg_info_ctx("incorrect key: %z, while %z expected",
						 key_len, pbkdf->key_len);
			g_free(salt_decoded);
			g_free(key_decoded); /* valid even if key_decoded == NULL */

			return FALSE;
		}

		local_key = g_alloca(pbkdf->key_len);
		rspamd_cryptobox_pbkdf(password->begin, password->len,
							   salt_decoded, salt_len,
							   local_key, pbkdf->key_len, pbkdf->complexity,
							   pbkdf->type);

		if (rspamd_constant_memcmp(key_decoded, local_key, pbkdf->key_len)) {
			ret = TRUE;
		}
		else {
			msg_info_ctx("incorrect or absent password has been specified");
		}

		g_free(salt_decoded);
		g_free(key_decoded);
	}
	else {
		msg_err_ctx("cannot check password: the configured hash is malformed, "
					"it has a valid id but no salt and/or no key component; "
					"denying authentication");
	}

	if (ret) {
		/* Save cached version */
		cache = is_enable ? &ctx->cached_enable_password : &ctx->cached_password;

		if (cache->len == 0) {
			/* Mmap region */
#ifdef MAP_NOCORE
			m = mmap(NULL, password->len, PROT_WRITE,
					 MAP_PRIVATE | MAP_ANON | MAP_NOCORE, -1, 0);
#else
			m = mmap(NULL, password->len, PROT_WRITE,
					 MAP_PRIVATE | MAP_ANON, -1, 0);
#endif
			if (m != MAP_FAILED) {
				memcpy(m, password->begin, password->len);
				(void) mprotect(m, password->len, PROT_READ);
				(void) mlock(m, password->len);
				cache->begin = m;
				cache->len = password->len;
			}
			else {
				msg_err_ctx("cannot store cached password, mmap failed: %s",
							strerror(errno));
			}
		}
	}

	return ret;
}

/**
 * Checks for X-Forwarded-For header and update client's address if needed
 *
 * This function is intended to be called for a trusted client to ensure that
 * a request is not proxied through it
 * @return 0 if no forwarded found, 1 if forwarded found and it is yet trusted
 * and -1 if forwarded is denied
 */
static int
rspamd_controller_check_forwarded(struct rspamd_controller_session *session,
								  struct rspamd_http_message *msg,
								  struct rspamd_controller_worker_ctx *ctx)
{
	const rspamd_ftok_t *hdr;
	const char *comma;
	const char *hdr_name = "X-Forwarded-For", *alt_hdr_name = "X-Real-IP";
	char ip_buf[INET6_ADDRSTRLEN + 1];
	rspamd_inet_addr_t *addr = NULL;
	int ret = 0;

	hdr = rspamd_http_message_find_header(msg, hdr_name);

	if (hdr) {
		/*
		 * We need to parse and update the header
		 * X-Forwarded-For: client, proxy1, proxy2
		 */
		comma = rspamd_memrchr(hdr->begin, ',', hdr->len);
		if (comma != NULL) {
			while (comma < hdr->begin + hdr->len &&
				   (*comma == ',' || g_ascii_isspace(*comma))) {
				comma++;
			}
		}
		else {
			comma = hdr->begin;
		}
		if (rspamd_parse_inet_address(&addr, comma,
									  (hdr->begin + hdr->len) - comma,
									  RSPAMD_INET_ADDRESS_PARSE_NO_UNIX)) {
			/* We have addr now, so check if it is still trusted */
			if (ctx->secure_map &&
				rspamd_match_radix_map_addr(ctx->secure_map, addr) != NULL) {
				/* rspamd_inet_address_to_string is not reentrant */
				rspamd_strlcpy(ip_buf, rspamd_inet_address_to_string(addr),
							   sizeof(ip_buf));
				msg_info_session("allow unauthorized proxied connection "
								 "from a trusted IP %s via %s",
								 ip_buf,
								 rspamd_inet_address_to_string(session->from_addr));
				ret = 1;
			}
			else {
				ret = -1;
			}

			rspamd_inet_address_free(addr);
		}
		else {
			msg_warn_session("cannot parse forwarded IP: %T", hdr);
			ret = -1;
		}
	}
	else {
		/* Try also X-Real-IP */
		hdr = rspamd_http_message_find_header(msg, alt_hdr_name);

		if (hdr) {
			if (rspamd_parse_inet_address(&addr, hdr->begin, hdr->len,
										  RSPAMD_INET_ADDRESS_PARSE_NO_UNIX)) {
				/* We have addr now, so check if it is still trusted */
				if (ctx->secure_map &&
					rspamd_match_radix_map_addr(ctx->secure_map, addr) != NULL) {
					/* rspamd_inet_address_to_string is not reentrant */
					rspamd_strlcpy(ip_buf, rspamd_inet_address_to_string(addr),
								   sizeof(ip_buf));
					msg_info_session("allow unauthorized proxied connection "
									 "from a trusted IP %s via %s",
									 ip_buf,
									 rspamd_inet_address_to_string(session->from_addr));
					ret = 1;
				}
				else {
					ret = -1;
				}

				rspamd_inet_address_free(addr);
			}
			else {
				msg_warn_session("cannot parse real IP: %T", hdr);
				ret = -1;
			}
		}
	}

	return ret;
}

/*
 * Whether this connection may use the privileged File/Path/Shm message source
 * inputs, which make rspamd open an object named by the client in the server's
 * own filesystem or shared memory.
 *
 * This is a property of the transport the connection was accepted on and of
 * nothing else. Authentication and this capability are deliberately separate:
 * a correct `enable_password` proves who the client is, it does not make the
 * client local, so it must not unlock filesystem access. The password-less
 * shortcuts of `rspamd_controller_check_password` must not leak in here either
 * — the AF_UNIX one happens to coincide with the rule below, but a `secure_ip`
 * peer is still an ordinary TCP client and stays gated.
 *
 * Nothing that the client controls (headers, `Forwarded`, `User-Agent`, query
 * arguments, request metadata) may be consulted here.
 */
static gboolean
rspamd_controller_allow_file_shm(struct rspamd_controller_session *session)
{
	if (session->from_addr != NULL &&
		rspamd_inet_address_get_af(session->from_addr) == AF_UNIX) {
		/*
		 * A unix socket peer already needs filesystem access to reach us, so
		 * naming a file adds no privileges it does not have.
		 */
		return TRUE;
	}

	return session->ctx->allow_file_and_shm_inputs;
}

/*
 * Propagates the properties of the accepted transport onto a task created for
 * this session. Must be called before anything can reach
 * `rspamd_task_load_message` (or the v3 request parser), as those are the
 * points where a privileged input would otherwise be opened.
 */
static void
rspamd_controller_task_set_transport(struct rspamd_controller_session *session,
									 struct rspamd_task *task)
{
	if (!rspamd_controller_allow_file_shm(session)) {
		task->protocol_flags &= ~RSPAMD_TASK_PROTOCOL_FLAG_ALLOW_FILE_SHM_INPUT;
	}

	/* Locality is derived from the peer address only, never from a header */
	if (session->from_addr != NULL &&
		rspamd_worker_addr_is_loopback(session->from_addr)) {
		task->protocol_flags |= RSPAMD_TASK_PROTOCOL_FLAG_LOCAL_CLIENT;
	}
	else {
		task->protocol_flags &= ~RSPAMD_TASK_PROTOCOL_FLAG_LOCAL_CLIENT;
	}

	/*
	 * The session owns its address and outlives the task only in the sense that
	 * it frees it in the finish handler, so the task gets its own copy.
	 */
	if (task->client_addr == NULL && session->from_addr != NULL) {
		task->client_addr = rspamd_inet_address_copy(session->from_addr, NULL);
	}
}

/*
 * A leaky bucket of failed authentication attempts for a single source address.
 * `penalty` is decayed lazily on access, so no timer is needed to drain it.
 */
struct rspamd_controller_auth_bucket {
	double penalty;
	ev_tstamp last_update;
};

/*
 * Returns the bucket's penalty decayed to `now`. A full bucket drains in
 * exactly `auth_failure_window` seconds.
 */
static double
rspamd_controller_auth_decay(struct rspamd_controller_worker_ctx *ctx,
							 struct rspamd_controller_auth_bucket *bucket,
							 ev_tstamp now)
{
	double leaked, elapsed;

	elapsed = now - bucket->last_update;

	if (elapsed <= 0) {
		/* Clock went backwards, do not gift the source any credit */
		return bucket->penalty;
	}

	leaked = elapsed * ((double) ctx->max_auth_failures / ctx->auth_failure_window);

	return MAX(0.0, bucket->penalty - leaked);
}

/*
 * Checks whether a source address is still allowed to attempt authentication.
 * This must be called *before* any KDF invocation: verifying a password is
 * deliberately expensive (tens of milliseconds), and the controller runs a
 * single event loop, so an unthrottled stream of wrong passwords from one
 * source is enough to stall every other request the worker serves.
 */
static gboolean
rspamd_controller_auth_is_allowed(struct rspamd_controller_worker_ctx *ctx,
								  const rspamd_inet_addr_t *from_addr)
{
	struct rspamd_controller_auth_bucket *bucket;
	ev_tstamp now;

	if (ctx->auth_failures == NULL || ctx->max_auth_failures == 0) {
		/* Throttling is disabled */
		return TRUE;
	}

	now = ev_now(ctx->event_loop);
	bucket = rspamd_lru_hash_lookup(ctx->auth_failures, from_addr, (time_t) now);

	if (bucket == NULL) {
		return TRUE;
	}

	return rspamd_controller_auth_decay(ctx, bucket, now) < (double) ctx->max_auth_failures;
}

/*
 * Accounts a failed authentication attempt against its source address.
 */
static void
rspamd_controller_auth_failure(struct rspamd_controller_worker_ctx *ctx,
							   const rspamd_inet_addr_t *from_addr)
{
	struct rspamd_controller_auth_bucket *bucket;
	ev_tstamp now;

	if (ctx->auth_failures == NULL || ctx->max_auth_failures == 0) {
		return;
	}

	now = ev_now(ctx->event_loop);
	bucket = rspamd_lru_hash_lookup(ctx->auth_failures, from_addr, (time_t) now);

	if (bucket != NULL) {
		bucket->penalty = rspamd_controller_auth_decay(ctx, bucket, now) + 1.0;
		bucket->last_update = now;
	}
	else {
		bucket = g_malloc0(sizeof(*bucket));
		bucket->penalty = 1.0;
		bucket->last_update = now;
		/*
		 * The TTL only reclaims idle entries: a bucket always decays to zero
		 * within `auth_failure_window` anyway, so expiry can never be laxer
		 * than the decay itself.
		 */
		rspamd_lru_hash_insert(ctx->auth_failures,
							   rspamd_inet_address_copy(from_addr, NULL),
							   bucket,
							   (time_t) now,
							   (unsigned int) ctx->auth_failure_window);
	}
}

/*
 * Clears the penalty of a source that has just authenticated successfully, so
 * that an operator who mistyped a password a few times is not left throttled.
 */
static void
rspamd_controller_auth_success(struct rspamd_controller_worker_ctx *ctx,
							   const rspamd_inet_addr_t *from_addr)
{
	if (ctx->auth_failures == NULL || ctx->max_auth_failures == 0) {
		return;
	}

	rspamd_lru_hash_remove(ctx->auth_failures, from_addr);
}

/* Check for password if it is required by configuration */
static gboolean
rspamd_controller_check_password(struct rspamd_http_connection_entry *entry,
								 struct rspamd_controller_session *session,
								 struct rspamd_http_message *msg, gboolean is_enable)
{
	const char *check;
	const rspamd_ftok_t *password;
	rspamd_ftok_t lookup;
	GHashTable *query_args = NULL;
	struct rspamd_controller_worker_ctx *ctx = session->ctx;
	gboolean check_normal = FALSE, check_enable = FALSE, ret = TRUE,
			 use_enable = FALSE;
	const struct rspamd_controller_pbkdf *pbkdf = NULL;
	/*
	 * Both passwords configured to the very same hash: the enable check would
	 * repeat the normal one verbatim, so its (expensive) KDF can be skipped and
	 * its verdict reused.
	 */
	const gboolean same_pw = (ctx->password != NULL && ctx->enable_password != NULL &&
							  strcmp(ctx->password, ctx->enable_password) == 0);

	/* Fail-safety */
	session->is_read_only = TRUE;

	/* Access list logic */
	if (rspamd_inet_address_get_af(session->from_addr) == AF_UNIX) {
		ret = rspamd_controller_check_forwarded(session, msg, ctx);

		if (ret == 1) {
			session->is_read_only = FALSE;

			return TRUE;
		}
		else if (ret == 0) {
			/* No forwarded found */
			msg_info_session("allow unauthorized connection from a unix socket");
			session->is_read_only = FALSE;

			return TRUE;
		}
	}
	else if (ctx->secure_map && rspamd_match_radix_map_addr(ctx->secure_map, session->from_addr) != NULL) {
		ret = rspamd_controller_check_forwarded(session, msg, ctx);

		if (ret == 1) {
			session->is_read_only = FALSE;

			return TRUE;
		}
		else if (ret == 0) {
			/* No forwarded found */
			msg_info_session("allow unauthorized connection from a trusted IP %s",
							 rspamd_inet_address_to_string(session->from_addr));
			session->is_read_only = FALSE;

			return TRUE;
		}
	}

	/*
	 * Everything below can reach the KDF, so throttle sources that keep
	 * failing before spending any CPU on them.
	 */
	if (!rspamd_controller_auth_is_allowed(ctx, session->from_addr)) {
		msg_info_session("throttling authentication: too many failures; source ip: %s",
						 rspamd_inet_address_to_string_pretty(session->from_addr));
		rspamd_controller_send_error(entry, 429, "Too many authentication failures");

		return FALSE;
	}

	/* Password logic */
	password = rspamd_http_message_find_header(msg, "Password");

	if (password == NULL) {
		/* Try to get password from query args */
		query_args = rspamd_http_message_parse_query(msg);

		lookup.begin = (char *) "password";
		lookup.len = sizeof("password") - 1;

		password = g_hash_table_lookup(query_args, &lookup);
	}

	if (password == NULL) {
		if (ctx->secure_map == NULL) {
			if (ctx->password == NULL && !is_enable) {
				return TRUE;
			}
			else if (is_enable && (ctx->password == NULL &&
								   ctx->enable_password == NULL)) {
				session->is_read_only = FALSE;
				return TRUE;
			}
		}

		msg_info_session("absent password has been specified; source ip: %s",
						 rspamd_inet_address_to_string_pretty(session->from_addr));
		ret = FALSE;
	}
	else {
		if (rspamd_ftok_cstr_equal(password, "q1", FALSE) ||
			rspamd_ftok_cstr_equal(password, "q2", FALSE)) {
			msg_info_session("deny default password for remote access; source ip: %s",
							 rspamd_inet_address_to_string_pretty(session->from_addr));
			ret = FALSE;
			goto end;
		}

		if (is_enable) {
			/* For privileged commands we strictly require enable password */
			if (ctx->enable_password != NULL) {
				check = ctx->enable_password;
				use_enable = TRUE;
			}
			else {
				/* Use just a password (legacy mode) */
				msg_info(
					"using password as enable_password for a privileged command");
				check = ctx->password;
			}

			if (check != NULL) {
				if (!rspamd_is_encrypted_password(check, &pbkdf)) {
					ret = FALSE;

					if (strlen(check) == password->len) {
						ret = rspamd_constant_memcmp(password->begin, check,
													 password->len);
					}
				}
				else {
					ret = rspamd_check_encrypted_password(ctx, password, check,
														  pbkdf, use_enable);
				}

				if (ret) {
					check_enable = TRUE;
				}
			}
			else {
				msg_warn_session(
					"no password to check while executing a privileged command; source ip: %s",
					rspamd_inet_address_to_string_pretty(session->from_addr));
				ret = FALSE;
			}

			if (ret) {
				session->is_read_only = FALSE;
			}
		}
		else {
			/* Accept both normal and enable passwords */
			if (ctx->password != NULL) {
				check = ctx->password;

				if (!rspamd_is_encrypted_password(check, &pbkdf)) {
					check_normal = FALSE;

					if (strlen(check) == password->len) {
						check_normal = rspamd_constant_memcmp(password->begin,
															  check,
															  password->len);
					}
				}
				else {
					check_normal = rspamd_check_encrypted_password(ctx,
																   password,
																   check, pbkdf, FALSE);
				}

				if (check_normal) {
					if (ctx->enable_password == NULL) {
						/* We have passed password check and no enable password is specified */
						session->is_read_only = FALSE;
					}
					else if (same_pw) {
						/* Identical to the check we have just passed */
						check_enable = TRUE;
					}
					else {
						/*
						 * Even if we have passed normal password check, we don't really
						 * know if password == enable_password, so we need to check it
						 * as well, to decide if we are in read-only mode or not
						 */
						check = ctx->enable_password;

						if (!rspamd_is_encrypted_password(check, &pbkdf)) {
							check_enable = FALSE;

							if (strlen(check) == password->len) {
								check_enable = rspamd_constant_memcmp(password->begin,
																	  check,
																	  password->len);
							}
						}
						else {
							check_enable = rspamd_check_encrypted_password(ctx,
																		   password,
																		   check, pbkdf, TRUE);
						}
					}
				}
			}

			/*
			 * `same_pw` implies the normal check above already ran against
			 * this very hash and rejected the password, so repeating it here
			 * would only burn another KDF for the same verdict.
			 */
			if ((!check_normal && !check_enable) && ctx->enable_password != NULL &&
				!same_pw) {
				check = ctx->enable_password;

				if (!rspamd_is_encrypted_password(check, &pbkdf)) {
					check_enable = FALSE;

					if (strlen(check) == password->len) {
						check_enable = rspamd_constant_memcmp(password->begin,
															  check,
															  password->len);
					}
				}
				else {
					check_enable = rspamd_check_encrypted_password(ctx,
																   password,
																   check, pbkdf, TRUE);
				}
			}

			if (check_enable) {
				/* We have passed enable password check, not a read-only mode */
				session->is_read_only = FALSE;
			}
		}
	}

	if (check_normal == FALSE && check_enable == FALSE) {
		msg_info("absent or incorrect password has been specified; source ip: %s",
				 rspamd_inet_address_to_string_pretty(session->from_addr));
		ret = FALSE;
	}

end:
	if (query_args != NULL) {
		g_hash_table_unref(query_args);
	}

	if (!ret) {
		rspamd_controller_auth_failure(ctx, session->from_addr);
		rspamd_controller_send_error(entry, 401, "Unauthorized");
	}
	else {
		rspamd_controller_auth_success(ctx, session->from_addr);
	}

	return ret;
}

/* Command handlers */

/*
 * Auth command handler:
 * request: /auth
 * headers: Password
 * reply: json {"auth": "ok", "version": "0.5.2", "uptime": "some uptime", "error": "none"}
 */
static int
rspamd_controller_handle_auth(struct rspamd_http_connection_entry *conn_ent,
							  struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_stat st;
	int64_t uptime;
	gulong data[5];
	ucl_object_t *obj;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	obj = ucl_object_typed_new(UCL_OBJECT);
	memcpy(&st, session->ctx->srv->stat, sizeof(st));
	data[0] = st.actions_stat[METRIC_ACTION_NOACTION];
	data[1] = st.actions_stat[METRIC_ACTION_ADD_HEADER] +
			  st.actions_stat[METRIC_ACTION_REWRITE_SUBJECT];
	data[2] = st.actions_stat[METRIC_ACTION_GREYLIST];
	data[3] = st.actions_stat[METRIC_ACTION_REJECT];
	data[4] = st.actions_stat[METRIC_ACTION_SOFT_REJECT];

	/* Get uptime */
	uptime = ev_time() - session->ctx->srv->start_time;

	ucl_object_insert_key(obj, ucl_object_fromstring(RVERSION), "version", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromstring("ok"), "auth", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(uptime), "uptime", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(data[0]), "clean", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(data[1]), "probable", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(data[2]), "greylist", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(data[3]), "reject", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(data[4]), "soft_reject", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(st.messages_scanned), "scanned", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromint(st.messages_learned), "learned", 0, false);
	ucl_object_insert_key(obj, ucl_object_frombool(session->is_read_only),
						  "read_only", 0, false);
	ucl_object_insert_key(obj, ucl_object_fromstring(session->ctx->cfg->checksum),
						  "config_id", 0, false);

	rspamd_controller_send_ucl(conn_ent, obj);
	ucl_object_unref(obj);

	return 0;
}

/*
 * Symbols command handler:
 * request: /symbols
 * reply: json [{
 *  "name": "group_name",
 *  "symbols": [
 *      {
 *      "name": "name",
 *      "weight": 0.1,
 *      "description": "description of symbol"
 *      },
 *      {...}
 * },
 * {...}]
 */
static int
rspamd_controller_handle_symbols(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	GHashTableIter it, sit;
	struct rspamd_symbols_group *gr;
	struct rspamd_symbol *sym;
	ucl_object_t *obj, *top, *sym_obj, *group_symbols;
	gpointer k, v;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	top = ucl_object_typed_new(UCL_ARRAY);

	/* Go through all symbols groups in the default metric */
	g_hash_table_iter_init(&it, session->cfg->groups);

	while (g_hash_table_iter_next(&it, &k, &v)) {
		gr = v;
		obj = ucl_object_typed_new(UCL_OBJECT);
		ucl_object_insert_key(obj, ucl_object_fromstring(gr->name), "group", 0, false);
		/* Iterate through all symbols */

		g_hash_table_iter_init(&sit, gr->symbols);
		group_symbols = ucl_object_typed_new(UCL_ARRAY);

		while (g_hash_table_iter_next(&sit, &k, &v)) {
			double tm = 0.0, freq = 0, freq_dev = 0;

			sym = v;
			sym_obj = ucl_object_typed_new(UCL_OBJECT);

			ucl_object_insert_key(sym_obj, ucl_object_fromstring(sym->name),
								  "symbol", 0, false);
			ucl_object_insert_key(sym_obj,
								  ucl_object_fromdouble(*sym->weight_ptr),
								  "weight", 0, false);
			if (sym->description) {
				ucl_object_insert_key(sym_obj,
									  ucl_object_fromstring(sym->description),
									  "description", 0, false);
			}

			if (rspamd_symcache_stat_symbol(session->ctx->cfg->cache,
											sym->name, &freq, &freq_dev, &tm, NULL)) {
				ucl_object_insert_key(sym_obj,
									  ucl_object_fromdouble(freq),
									  "frequency", 0, false);
				ucl_object_insert_key(sym_obj,
									  ucl_object_fromdouble(freq_dev),
									  "frequency_stddev", 0, false);
				ucl_object_insert_key(sym_obj,
									  ucl_object_fromdouble(tm),
									  "time", 0, false);
			}

			ucl_array_append(group_symbols, sym_obj);
		}

		ucl_object_insert_key(obj, group_symbols, "rules", 0, false);
		ucl_array_append(top, obj);
	}

	rspamd_controller_send_ucl(conn_ent, top);
	ucl_object_unref(top);

	return 0;
}

static void
rspamd_controller_actions_cb(struct rspamd_action *act, void *cbd)
{
	ucl_object_t *top = (ucl_object_t *) cbd;
	ucl_object_t *obj = ucl_object_typed_new(UCL_OBJECT);
	ucl_object_insert_key(obj,
						  ucl_object_fromstring(act->name),
						  "action", 0, false);
	ucl_object_insert_key(obj,
						  ucl_object_fromdouble(act->threshold),
						  "value", 0, false);
	ucl_array_append(top, obj);
}

/*
 * Actions command handler:
 * request: /actions
 * reply: json [{
 *  "action": "no action",
 *  "value": 1.1
 * },
 * {...}]
 */
static int
rspamd_controller_handle_actions(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	ucl_object_t *top;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	top = ucl_object_typed_new(UCL_ARRAY);

	rspamd_config_actions_foreach(session->cfg, rspamd_controller_actions_cb, top);
	rspamd_controller_send_ucl(conn_ent, top);
	ucl_object_unref(top);

	return 0;
}

static gboolean
rspamd_controller_can_edit_map(struct rspamd_map_backend *bk)
{
	char *fpath;

	if (access(bk->uri, W_OK) == 0) {
		return TRUE;
	}
	else if (access(bk->uri, R_OK) == -1 && errno == ENOENT) {
		fpath = g_path_get_dirname(bk->uri);

		if (fpath) {
			if (access(fpath, W_OK) == 0) {
				g_free(fpath);

				return TRUE;
			}

			g_free(fpath);
		}
	}

	return FALSE;
}

/*
 * Maps command handler:
 * request: /maps
 * headers: Password
 * reply: json [
 *      {
 *      "map": "name",
 *      "description": "description",
 *      "editable": true
 *      },
 *      {...}
 * ]
 */
static int
rspamd_controller_handle_maps(struct rspamd_http_connection_entry *conn_ent,
							  struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	GList *cur;
	struct rspamd_map *map;
	struct rspamd_map_backend *bk;
	unsigned int i;
	gboolean editable;
	ucl_object_t *obj, *top;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	top = ucl_object_typed_new(UCL_ARRAY);

	/* Iterate over all maps */
	cur = session->ctx->cfg->maps;
	while (cur) {
		map = cur->data;

		PTR_ARRAY_FOREACH(map->backends, i, bk)
		{

			if (bk->protocol == MAP_PROTO_FILE) {
				editable = rspamd_controller_can_edit_map(bk);
				obj = ucl_object_typed_new(UCL_OBJECT);
				ucl_object_insert_key(obj, ucl_object_fromint(bk->id),
									  "map", 0, false);
				if (map->description) {
					ucl_object_insert_key(obj, ucl_object_fromstring(map->description),
										  "description", 0, false);
				}
				ucl_object_insert_key(obj, ucl_object_fromstring(bk->uri),
									  "uri", 0, false);
				ucl_object_insert_key(obj, ucl_object_fromstring("file"),
									  "type", 0, false);
				ucl_object_insert_key(obj, ucl_object_frombool(editable),
									  "editable", 0, false);
				ucl_object_insert_key(obj, ucl_object_frombool(map->shared->loaded),
									  "loaded", 0, false);
				ucl_object_insert_key(obj, ucl_object_frombool(map->shared->cached),
									  "cached", 0, false);
				ucl_array_append(top, obj);
			}
			else {
				obj = ucl_object_typed_new(UCL_OBJECT);
				ucl_object_insert_key(obj, ucl_object_fromint(bk->id),
									  "map", 0, false);
				if (map->description) {
					ucl_object_insert_key(obj, ucl_object_fromstring(map->description),
										  "description", 0, false);
				}
				ucl_object_insert_key(obj, ucl_object_fromstring(bk->uri),
									  "uri", 0, false);
				ucl_object_insert_key(obj, ucl_object_fromstring(rspamd_map_fetch_protocol_name(bk->protocol)),
									  "type", 0, false);
				ucl_object_insert_key(obj, ucl_object_frombool(false),
									  "editable", 0, false);
				ucl_object_insert_key(obj, ucl_object_frombool(map->shared->loaded),
									  "loaded", 0, false);
				ucl_object_insert_key(obj, ucl_object_frombool(map->shared->cached),
									  "cached", 0, false);
				ucl_array_append(top, obj);
			}
		}
		cur = g_list_next(cur);
	}

	rspamd_controller_send_ucl(conn_ent, top);
	ucl_object_unref(top);

	return 0;
}

gboolean
rspamd_controller_map_traverse_callback(gconstpointer key, gconstpointer value, gsize _hits, gpointer ud)
{
	rspamd_fstring_t **target = (rspamd_fstring_t **) ud;

	*target = rspamd_fstring_append(*target, key, strlen(key));

	if (value) {
		*target = rspamd_fstring_append(*target, " ", 1);
		*target = rspamd_fstring_append(*target, value, strlen(value));
	}
	*target = rspamd_fstring_append(*target, "\n", 1);

	return TRUE;
}
/*
 * Get map command handler:
 * request: /getmap
 * headers: Password, Map
 * reply: plain-text
 */
static int
rspamd_controller_handle_get_map(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	GList *cur;
	struct rspamd_map *map = NULL;
	struct rspamd_map_backend *bk = NULL;
	const rspamd_ftok_t *idstr;
	struct stat st;
	int fd;
	gulong id, i;
	gboolean found = FALSE;
	struct rspamd_http_message *reply;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	idstr = rspamd_http_message_find_header(msg, "Map");

	if (idstr == NULL) {
		msg_info_session("absent map id");
		rspamd_controller_send_error(conn_ent, 400, "Id header missing");
		return 0;
	}

	if (!rspamd_strtoul(idstr->begin, idstr->len, &id)) {
		msg_info_session("invalid map id");
		rspamd_controller_send_error(conn_ent, 400, "Invalid map id");
		return 0;
	}

	/* Now let's be sure that we have map defined in configuration */
	cur = session->ctx->cfg->maps;
	while (cur && !found) {
		map = cur->data;

		PTR_ARRAY_FOREACH(map->backends, i, bk)
		{
			if (bk->id == id) {
				found = TRUE;
				break;
			}
		}

		cur = g_list_next(cur);
	}

	if (!found || bk == NULL) {
		msg_info_session("map not found");
		rspamd_controller_send_error(conn_ent, 404, "Map not found");
		return 0;
	}

	if (bk->protocol == MAP_PROTO_FILE) {
		if (stat(bk->uri, &st) == -1 || (fd = open(bk->uri, O_RDONLY)) == -1) {
			reply = rspamd_http_new_message(HTTP_RESPONSE);
			reply->date = time(NULL);
			reply->code = 200;
		}
		else {

			reply = rspamd_http_new_message(HTTP_RESPONSE);
			reply->date = time(NULL);
			reply->code = 200;

			if (st.st_size > 0) {
				if (!rspamd_http_message_set_body_from_fd(reply, fd)) {
					close(fd);
					rspamd_http_message_unref(reply);
					msg_err_session("cannot read map %s: %s", bk->uri, strerror(errno));
					rspamd_controller_send_error(conn_ent, 500, "Map read error");
					return 0;
				}
			}
			else {
				rspamd_fstring_t *empty_body = rspamd_fstring_new_init("", 0);
				rspamd_http_message_set_body_from_fstring_steal(reply, empty_body);
			}

			close(fd);
		}
	}
	else if (bk->protocol == MAP_PROTO_STATIC) {
		/* We can just traverse map and form reply */
		reply = rspamd_http_new_message(HTTP_RESPONSE);
		reply->code = 200;
		rspamd_fstring_t *map_body = rspamd_fstring_new();
		rspamd_map_traverse(bk->map, rspamd_controller_map_traverse_callback, &map_body, FALSE);
		rspamd_http_message_set_body_from_fstring_steal(reply, map_body);
	}
	else if (map->shared->loaded) {
		reply = rspamd_http_new_message(HTTP_RESPONSE);
		reply->code = 200;
		rspamd_fstring_t *map_body = rspamd_fstring_new();
		rspamd_map_traverse(bk->map, rspamd_controller_map_traverse_callback, &map_body, FALSE);
		rspamd_http_message_set_body_from_fstring_steal(reply, map_body);
	}
	else {
		reply = rspamd_http_new_message(HTTP_RESPONSE);
		reply->code = 404;
	}

	rspamd_http_connection_reset(conn_ent->conn);
	rspamd_http_router_insert_headers(conn_ent->rt, reply);
	rspamd_http_connection_write_message(conn_ent->conn, reply, NULL,
										 "text/plain", conn_ent,
										 conn_ent->rt->timeout);
	conn_ent->is_reply = TRUE;

	return 0;
}

static ucl_object_t *
rspamd_controller_pie_element(enum rspamd_action_type action,
							  const char *label, double data)
{
	ucl_object_t *res = ucl_object_typed_new(UCL_OBJECT);
	const char *colors[METRIC_ACTION_MAX] = {
		[METRIC_ACTION_REJECT] = "#FF0000",
		[METRIC_ACTION_SOFT_REJECT] = "#cc9966",
		[METRIC_ACTION_REWRITE_SUBJECT] = "#ff6600",
		[METRIC_ACTION_ADD_HEADER] = "#FFD700",
		[METRIC_ACTION_GREYLIST] = "#436EEE",
		[METRIC_ACTION_NOACTION] = "#66cc00"};

	ucl_object_insert_key(res, ucl_object_fromstring(colors[action]),
						  "color", 0, false);
	ucl_object_insert_key(res, ucl_object_fromstring(label), "label", 0, false);
	ucl_object_insert_key(res, ucl_object_fromdouble(data), "data", 0, false);
	ucl_object_insert_key(res, ucl_object_fromdouble(data), "value", 0, false);

	return res;
}

/*
 * Pie chart command handler:
 * request: /pie
 * headers: Password
 * reply: json [
 *      { label: "Foo", data: 11 },
 *      { label: "Bar", data: 20 },
 *      {...}
 * ]
 */
static int
rspamd_controller_handle_pie_chart(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	double data[5], total;
	ucl_object_t *top;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	top = ucl_object_typed_new(UCL_ARRAY);
	total = ctx->srv->stat->messages_scanned;
	if (total != 0) {

		data[0] = ctx->srv->stat->actions_stat[METRIC_ACTION_NOACTION];
		data[1] = ctx->srv->stat->actions_stat[METRIC_ACTION_SOFT_REJECT];
		data[2] = (ctx->srv->stat->actions_stat[METRIC_ACTION_ADD_HEADER] +
				   ctx->srv->stat->actions_stat[METRIC_ACTION_REWRITE_SUBJECT]);
		data[3] = ctx->srv->stat->actions_stat[METRIC_ACTION_GREYLIST];
		data[4] = ctx->srv->stat->actions_stat[METRIC_ACTION_REJECT];
	}
	else {
		memset(data, 0, sizeof(data));
	}
	ucl_array_append(top, rspamd_controller_pie_element(
							  METRIC_ACTION_NOACTION, "Clean", data[0]));
	ucl_array_append(top, rspamd_controller_pie_element(
							  METRIC_ACTION_SOFT_REJECT, "Temporarily rejected", data[1]));
	ucl_array_append(top, rspamd_controller_pie_element(
							  METRIC_ACTION_ADD_HEADER, "Probable spam", data[2]));
	ucl_array_append(top, rspamd_controller_pie_element(
							  METRIC_ACTION_GREYLIST, "Greylisted", data[3]));
	ucl_array_append(top, rspamd_controller_pie_element(
							  METRIC_ACTION_REJECT, "Rejected", data[4]));

	rspamd_controller_send_ucl(conn_ent, top);
	ucl_object_unref(top);

	return 0;
}

void rspamd_controller_graph_point(gulong t, gulong step,
								   struct rspamd_rrd_query_result *rrd_result,
								   double *acc,
								   ucl_object_t **elt)
{
	unsigned int nan_cnt;
	double sum = 0.0, yval;
	ucl_object_t *data_elt;
	unsigned int i, j;

	for (i = 0; i < rrd_result->ds_count; i++) {
		sum = 0.0;
		nan_cnt = 0;
		data_elt = ucl_object_typed_new(UCL_OBJECT);
		ucl_object_insert_key(data_elt, ucl_object_fromint(t), "x", 1, false);

		for (j = 0; j < step; j++) {
			yval = acc[i + j * rrd_result->ds_count];
			if (!isfinite(yval)) {
				nan_cnt++;
			}
			else {
				sum += yval;
			}
		}
		if (nan_cnt == step) {
			ucl_object_insert_key(data_elt, ucl_object_typed_new(UCL_NULL),
								  "y", 1, false);
		}
		else {
			ucl_object_insert_key(data_elt,
								  ucl_object_fromdouble(sum / (double) step), "y", 1,
								  false);
		}
		ucl_array_append(elt[i], data_elt);
	}
}

/*
 * Graph command handler:
 * request: /graph?type=<day|week|month|year>
 * headers: Password
 * reply: json [
 *      { label: "Foo", data: 11 },
 *      { label: "Bar", data: 20 },
 *      {...}
 * ]
 */
static int
rspamd_controller_handle_graph(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	GHashTable *query;
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	rspamd_ftok_t srch, *value;
	struct rspamd_rrd_query_result *rrd_result;
	gulong i, k, start_row, cnt, t, ts, step;
	double *acc;
	ucl_object_t *res, *elt[METRIC_ACTION_MAX];
	enum {
		rra_day = 0,
		rra_week,
		rra_month,
		rra_year,
		rra_invalid
	} rra_num = rra_invalid;
	/* How many points are we going to send to display */
	static const unsigned int desired_points = 500;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	if (ctx->rrd == NULL) {
		msg_err_session("no rrd configured");
		rspamd_controller_send_error(conn_ent, 404, "No rrd configured for graphs");

		return 0;
	}

	query = rspamd_http_message_parse_query(msg);
	srch.begin = (char *) "type";
	srch.len = 4;

	if (query == NULL || (value = g_hash_table_lookup(query, &srch)) == NULL) {
		msg_err_session("absent graph type query");
		rspamd_controller_send_error(conn_ent, 400, "Absent graph type");

		if (query) {
			g_hash_table_unref(query);
		}

		return 0;
	}

	if (value->len == 3 && rspamd_lc_cmp(value->begin, "day", value->len) == 0) {
		rra_num = rra_day;
	}
	else if (value->len == 4 && rspamd_lc_cmp(value->begin, "week", value->len) == 0) {
		rra_num = rra_week;
	}
	else if (value->len == 5 && rspamd_lc_cmp(value->begin, "month", value->len) == 0) {
		rra_num = rra_month;
	}
	else if (value->len == 4 && rspamd_lc_cmp(value->begin, "year", value->len) == 0) {
		rra_num = rra_year;
	}

	g_hash_table_unref(query);

	if (rra_num == rra_invalid) {
		msg_err_session("invalid graph type query");
		rspamd_controller_send_error(conn_ent, 400, "Invalid graph type");

		return 0;
	}

	rrd_result = rspamd_rrd_query(ctx->rrd, rra_num);

	if (rrd_result == NULL) {
		msg_err_session("cannot query rrd");
		rspamd_controller_send_error(conn_ent, 500, "Cannot query rrd");

		return 0;
	}

	g_assert(rrd_result->ds_count == G_N_ELEMENTS(elt));

	res = ucl_object_typed_new(UCL_ARRAY);
	/* How much full updates happened since the last update */
	ts = rrd_result->last_update / rrd_result->pdp_per_cdp - rrd_result->rra_rows;

	for (i = 0; i < rrd_result->ds_count; i++) {
		elt[i] = ucl_object_typed_new(UCL_ARRAY);
	}

	start_row = rrd_result->cur_row == rrd_result->rra_rows - 1 ? 0 : rrd_result->cur_row;
	t = ts * rrd_result->pdp_per_cdp;
	k = 0;

	/* Create window */
	step = ceil(((double) rrd_result->rra_rows) / desired_points);
	g_assert(step >= 1);
	acc = g_malloc0(sizeof(double) * rrd_result->ds_count * step);

	for (i = start_row, cnt = 0; cnt < rrd_result->rra_rows;
		 cnt++) {

		memcpy(&acc[k * rrd_result->ds_count],
			   &rrd_result->data[i * rrd_result->ds_count],
			   sizeof(double) * rrd_result->ds_count);

		if (k < step - 1) {
			k++;
		}
		else {
			t = ts * rrd_result->pdp_per_cdp;

			/* Need a fresh point */
			rspamd_controller_graph_point(t, step, rrd_result, acc, elt);
			k = 0;
		}

		if (i == rrd_result->rra_rows - 1) {
			i = 0;
		}
		else {
			i++;
		}

		ts++;
	}

	if (k > 0) {
		rspamd_controller_graph_point(t, k, rrd_result, acc, elt);
	}

	for (i = 0; i < rrd_result->ds_count; i++) {
		ucl_array_append(res, elt[i]);
	}

	rspamd_controller_send_ucl(conn_ent, res);
	ucl_object_unref(res);
	g_free(acc);
	g_free(rrd_result);

	return 0;
}

static void
rspamd_controller_handle_legacy_history(
	struct rspamd_controller_session *session,
	struct rspamd_controller_worker_ctx *ctx,
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct roll_history_row *row, *copied_rows;
	unsigned int i, rows_proc, row_num;
	struct tm tm;
	char timebuf[32], **syms;
	ucl_object_t *top, *obj;

	top = ucl_object_typed_new(UCL_ARRAY);

	/* Set lock on history */
	copied_rows = g_malloc(sizeof(*copied_rows) * ctx->srv->history->nrows);
	memcpy(copied_rows, ctx->srv->history->rows,
		   sizeof(*copied_rows) * ctx->srv->history->nrows);

	/* Go through all rows */
	row_num = ctx->srv->history->cur_row;

	for (i = 0, rows_proc = 0; i < ctx->srv->history->nrows; i++, row_num++) {
		if (row_num == ctx->srv->history->nrows) {
			row_num = 0;
		}
		row = &copied_rows[row_num];
		/* Get only completed rows */
		if (row->completed) {
			rspamd_localtime(row->timestamp, &tm);
			strftime(timebuf, sizeof(timebuf) - 1, "%Y-%m-%d %H:%M:%S", &tm);
			obj = ucl_object_typed_new(UCL_OBJECT);
			ucl_object_insert_key(obj, ucl_object_fromstring(timebuf), "time", 0, false);
			ucl_object_insert_key(obj, ucl_object_fromint(row->timestamp), "unix_time", 0, false);
			ucl_object_insert_key(obj, ucl_object_fromstring(row->message_id), "id", 0, false);
			ucl_object_insert_key(obj, ucl_object_fromstring(row->from_addr),
								  "ip", 0, false);
			ucl_object_insert_key(obj,
								  ucl_object_fromstring(rspamd_action_to_str(
									  row->action)),
								  "action", 0, false);

			if (!isnan(row->score)) {
				ucl_object_insert_key(obj, ucl_object_fromdouble(row->score), "score", 0, false);
			}
			else {
				ucl_object_insert_key(obj,
									  ucl_object_fromdouble(0.0), "score", 0, false);
			}

			if (!isnan(row->required_score)) {
				ucl_object_insert_key(obj,
									  ucl_object_fromdouble(
										  row->required_score),
									  "required_score", 0, false);
			}
			else {
				ucl_object_insert_key(obj,
									  ucl_object_fromdouble(0.0), "required_score", 0, false);
			}

			syms = g_strsplit_set(row->symbols, ", ", -1);

			if (syms) {
				unsigned int nelts = g_strv_length(syms);
				ucl_object_t *syms_obj = ucl_object_typed_new(UCL_OBJECT);
				ucl_object_reserve(syms_obj, nelts);

				for (unsigned int j = 0; j < nelts; j++) {
					g_strstrip(syms[j]);

					if (strlen(syms[j]) == 0) {
						/* Empty garbage */
						continue;
					}

					ucl_object_t *cur = ucl_object_typed_new(UCL_OBJECT);

					ucl_object_insert_key(cur, ucl_object_fromdouble(0.0),
										  "score", 0, false);
					ucl_object_insert_key(syms_obj, cur, syms[j], 0, true);
				}

				ucl_object_insert_key(obj, syms_obj, "symbols", 0, false);
				g_strfreev(syms);
			}

			ucl_object_insert_key(obj, ucl_object_fromint(row->len),
								  "size", 0, false);
			ucl_object_insert_key(obj,
								  ucl_object_fromdouble(row->scan_time),
								  "scan_time", 0, false);

			if (row->user[0] != '\0') {
				ucl_object_insert_key(obj, ucl_object_fromstring(row->user),
									  "user", 0, false);
			}
			if (row->from_addr[0] != '\0') {
				ucl_object_insert_key(obj, ucl_object_fromstring(row->from_addr), "from", 0, false);
			}
			ucl_array_append(top, obj);
			rows_proc++;
		}
	}

	rspamd_controller_send_ucl(conn_ent, top);
	ucl_object_unref(top);
	g_free(copied_rows);
}

static gboolean
rspamd_controller_history_lua_fin_task(void *ud)
{
	return TRUE;
}

static void
rspamd_controller_handle_lua_history(lua_State *L,
									 struct rspamd_controller_session *session,
									 struct rspamd_controller_worker_ctx *ctx,
									 struct rspamd_http_connection_entry *conn_ent,
									 struct rspamd_http_message *msg,
									 gboolean reset)
{
	struct rspamd_task *task, **ptask;
	struct rspamd_http_connection_entry **pconn_ent;
	GHashTable *params;
	rspamd_ftok_t srch, *found;
	glong from = 0, to = -1;

	params = rspamd_http_message_parse_query(msg);

	if (params) {
		/* Check from and to */
		RSPAMD_FTOK_ASSIGN(&srch, "from");
		found = g_hash_table_lookup(params, &srch);

		if (found) {
			rspamd_strtol(found->begin, found->len, &from);
		}
		RSPAMD_FTOK_ASSIGN(&srch, "to");
		found = g_hash_table_lookup(params, &srch);

		if (found) {
			rspamd_strtol(found->begin, found->len, &to);
		}

		g_hash_table_unref(params);
	}

	lua_getglobal(L, "rspamd_plugins");

	if (lua_istable(L, -1)) {
		lua_pushstring(L, "history");
		lua_gettable(L, -2);

		if (lua_istable(L, -1)) {
			lua_pushstring(L, "handler");
			lua_gettable(L, -2);

			if (lua_isfunction(L, -1)) {
				task = rspamd_task_new(session->ctx->worker, session->cfg,
									   session->pool, ctx->lang_det, ctx->event_loop, FALSE);

				task->resolver = ctx->resolver;
				task->s = rspamd_task_create_session(task, session->pool,
													 rspamd_controller_history_lua_fin_task,
													 NULL,
													 (event_finalizer_t) rspamd_task_free);
				task->fin_arg = conn_ent;
				rspamd_controller_task_set_transport(session, task);

				ptask = lua_newuserdata(L, sizeof(*ptask));
				*ptask = task;
				rspamd_lua_setclass(L, rspamd_task_classname, -1);
				pconn_ent = lua_newuserdata(L, sizeof(*pconn_ent));
				*pconn_ent = conn_ent;
				rspamd_lua_setclass(L, rspamd_csession_classname, -1);
				lua_pushinteger(L, from);
				lua_pushinteger(L, to);
				lua_pushboolean(L, reset);

				if (lua_pcall(L, 5, 0, 0) != 0) {
					msg_err_session("call to history function failed: %s",
									lua_tostring(L, -1));
					lua_settop(L, 0);
					rspamd_task_free(task);

					goto err;
				}

				task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
				task->sock = -1;
				session->task = task;

				rspamd_session_pending(task->s);
			}
			else {
				msg_err_session("rspamd_plugins.history.handler is not a function");
				lua_settop(L, 0);
				goto err;
			}
		}
		else {
			msg_err_session("rspamd_plugins.history is not a table");
			lua_settop(L, 0);
			goto err;
		}
	}
	else {
		msg_err_session("rspamd_plugins is absent or has incorrect type");
		lua_settop(L, 0);
		goto err;
	}

	lua_settop(L, 0);

	return;
err:
	rspamd_controller_send_error(conn_ent, 500, "Internal error");
}

/*
 * Healthy command handler:
 * request: /healthy
 * headers: Password
 * reply: json {"success":true}
 */
static int
rspamd_controller_handle_healthy(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	if (session->ctx->workers_hb_lost != 0) {
		rspamd_controller_send_error(conn_ent, 500,
									 "%d workers are not responding", session->ctx->workers_hb_lost);
	}
	else {
		rspamd_controller_send_string(conn_ent, "{\"success\":true}");
	}

	return 0;
}

/*
 * Ready command handler:
 * request: /ready
 * headers: Password
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_ready(struct rspamd_http_connection_entry *conn_ent,
							   struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	if (session->ctx->scanners_count == 0) {
		rspamd_controller_send_error(conn_ent, 500, "no healthy scanner workers are running");
	}
	else {
		rspamd_controller_send_string(conn_ent, "{\"success\":true}");
	}

	return 0;
}

/*
 * History command handler:
 * request: /history
 * headers: Password
 * reply: json [
 *      { label: "Foo", data: 11 },
 *      { label: "Bar", data: 20 },
 *      {...}
 * ]
 */
static int
rspamd_controller_handle_history(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	lua_State *L;
	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	L = ctx->cfg->lua_state;

	if (ctx->srv->history && !ctx->srv->history->disabled) {
		rspamd_controller_handle_legacy_history(session, ctx, conn_ent, msg);
	}
	else {
		rspamd_controller_handle_lua_history(L, session, ctx, conn_ent, msg,
											 FALSE);
	}

	return 0;
}

/*
 * Errors command handler:
 * request: /errors
 * headers: Password
 * reply: json [
 *      { ts: 100500, type: normal, pid: 100, module: lua, message: bad things },
 *      {...}
 * ]
 */
static int
rspamd_controller_handle_errors(struct rspamd_http_connection_entry *conn_ent,
								struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	ucl_object_t *top;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	top = rspamd_log_errorbuf_export(ctx->worker->srv->logger);
	rspamd_controller_send_ucl(conn_ent, top);
	ucl_object_unref(top);

	return 0;
}

/*
 * Neighbours command handler:
 * request: /neighbours
 * headers: Password
 * reply: json {name: {url: "http://...", host: "host"}}
 */
static int
rspamd_controller_handle_neighbours(struct rspamd_http_connection_entry *conn_ent,
									struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	rspamd_controller_send_ucl(conn_ent, ctx->cfg->neighbours);

	return 0;
}


static int
rspamd_controller_handle_history_reset(struct rspamd_http_connection_entry *conn_ent,
									   struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	unsigned int completed_rows;
	lua_State *L;

	ctx = session->ctx;
	L = ctx->cfg->lua_state;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	if (ctx->srv->history && !ctx->srv->history->disabled) {
		/*
		 * Clear the whole ring buffer and reset the current row pointer.
		 * History is lock-free by design: writers (rspamd_roll_history_update)
		 * claim a slot via atomic cur_row and gate visibility with the
		 * per-row `completed` flag, set last. This memset therefore races
		 * with a concurrent writer, just like the unlocked memcpy in the
		 * read path and the original "optimistic" reset. A row being updated
		 * during the memset may briefly look torn, but every fully-stale row
		 * stays hidden once its `completed` flag is zeroed. Reset is
		 * inherently destructive, so this race is an accepted trade-off.
		 */
		memset(ctx->srv->history->rows, 0,
			   sizeof(struct roll_history_row) * ctx->srv->history->nrows);
		g_atomic_int_set(&ctx->srv->history->cur_row, 0);
		completed_rows = ctx->srv->history->nrows;

		msg_info_session("<%s> cleared %d entries from history",
						 rspamd_inet_address_to_string(session->from_addr),
						 completed_rows);
		rspamd_controller_send_string(conn_ent, "{\"success\":true}");
	}
	else {
		rspamd_controller_handle_lua_history(L, session, ctx, conn_ent, msg,
											 TRUE);
	}

	return 0;
}

static gboolean
rspamd_controller_lua_fin_task(void *ud)
{
	struct rspamd_task *task = ud;
	struct rspamd_http_connection_entry *conn_ent;

	conn_ent = task->fin_arg;

	if (task->err != NULL) {
		rspamd_controller_send_error(conn_ent, task->err->code, "%s",
									 task->err->message);
	}

	return TRUE;
}

static int
rspamd_controller_handle_lua(struct rspamd_http_connection_entry *conn_ent,
							 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_task *task, **ptask;
	struct rspamd_http_connection_entry **pconn;
	struct rspamd_controller_worker_ctx *ctx;
	char filebuf[PATH_MAX], realbuf[PATH_MAX];
	struct http_parser_url u;
	rspamd_ftok_t lookup;
	struct stat st;
	lua_State *L;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	ctx = session->ctx;
	L = ctx->cfg->lua_state;

	/* Find lua script */
	if (msg->url != NULL && msg->url->len != 0) {

		http_parser_parse_url(RSPAMD_FSTRING_DATA(msg->url),
							  RSPAMD_FSTRING_LEN(msg->url), TRUE, &u);

		if (u.field_set & (1 << UF_PATH)) {
			lookup.begin = RSPAMD_FSTRING_DATA(msg->url) +
						   u.field_data[UF_PATH].off;
			lookup.len = u.field_data[UF_PATH].len;
		}
		else {
			lookup.begin = RSPAMD_FSTRING_DATA(msg->url);
			lookup.len = RSPAMD_FSTRING_LEN(msg->url);
		}

		rspamd_snprintf(filebuf, sizeof(filebuf), "%s%c%T",
						ctx->static_files_dir, G_DIR_SEPARATOR, &lookup);

		if (realpath(filebuf, realbuf) == NULL ||
			lstat(realbuf, &st) == -1) {
			rspamd_controller_send_error(conn_ent, 404, "Cannot find path: %s",
										 strerror(errno));

			return 0;
		}

		/* TODO: add caching here, should be trivial */
		/* Now we load and execute the code fragment, which should return a function */
		if (luaL_loadfile(L, realbuf) != 0) {
			rspamd_controller_send_error(conn_ent, 500, "Cannot load path: %s",
										 lua_tostring(L, -1));
			lua_settop(L, 0);

			return 0;
		}

		if (lua_pcall(L, 0, 1, 0) != 0) {
			rspamd_controller_send_error(conn_ent, 501, "Cannot run path: %s",
										 lua_tostring(L, -1));
			lua_settop(L, 0);

			return 0;
		}

		if (lua_type(L, -1) != LUA_TFUNCTION) {
			rspamd_controller_send_error(conn_ent, 502, "Bad return type: %s",
										 lua_typename(L, lua_type(L, -1)));
			lua_settop(L, 0);

			return 0;
		}
	}
	else {
		rspamd_controller_send_error(conn_ent, 404, "Empty path is not permitted");

		return 0;
	}

	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   ctx->lang_det, ctx->event_loop, FALSE);

	task->resolver = ctx->resolver;
	task->s = rspamd_task_create_session(task, session->pool,
										 rspamd_controller_lua_fin_task,
										 NULL,
										 (event_finalizer_t) rspamd_task_free);
	task->fin_arg = conn_ent;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = -1;
	session->task = task;
	rspamd_controller_task_set_transport(session, task);

	if (msg->body_buf.len > 0) {
		if (!rspamd_task_load_message(task, msg, msg->body_buf.begin, msg->body_buf.len)) {
			rspamd_controller_send_error(conn_ent, task->err->code, "%s",
										 task->err->message);
			return 0;
		}
	}

	ptask = lua_newuserdata(L, sizeof(*ptask));
	rspamd_lua_setclass(L, rspamd_task_classname, -1);
	*ptask = task;

	pconn = lua_newuserdata(L, sizeof(*pconn));
	rspamd_lua_setclass(L, rspamd_csession_classname, -1);
	*pconn = conn_ent;

	if (lua_pcall(L, 2, 0, 0) != 0) {
		rspamd_controller_send_error(conn_ent, 503, "Cannot run callback: %s",
									 lua_tostring(L, -1));
		lua_settop(L, 0);

		return 0;
	}

	rspamd_session_pending(task->s);

	return 0;
}

static gboolean
rspamd_controller_learn_fin_task(void *ud)
{
	struct rspamd_task *task = ud;
	struct rspamd_controller_session *session;
	struct rspamd_http_connection_entry *conn_ent;

	conn_ent = task->fin_arg;
	session = conn_ent->ud;

	if (task->err != NULL) {
		msg_info_session("cannot learn <%s>: %e",
						 MESSAGE_FIELD_CHECK(task, message_id), task->err);
		rspamd_controller_send_error(conn_ent, task->err->code, "%s",
									 task->err->message);

		return TRUE;
	}

	if (RSPAMD_TASK_IS_PROCESSED(task)) {
		/* Successful learn */
		const char *learn_class = rspamd_task_get_autolearn_class(task);
		msg_info_task("<%s> learned message as %s: %s",
					  rspamd_inet_address_to_string(session->from_addr),
					  learn_class ? learn_class : (session->is_spam ? "spam" : "ham"),
					  MESSAGE_FIELD_CHECK(task, message_id));
		rspamd_controller_send_string(conn_ent, "{\"success\":true}");
		return TRUE;
	}

	if (!rspamd_task_process(task, RSPAMD_TASK_PROCESS_LEARN)) {
		msg_info_task("cannot learn <%s>: %e",
					  MESSAGE_FIELD_CHECK(task, message_id), task->err);

		if (task->err) {
			rspamd_controller_send_error(conn_ent, task->err->code, "%s",
										 task->err->message);
		}
		else {
			rspamd_controller_send_error(conn_ent, 500,
										 "Internal error");
		}
	}

	if (RSPAMD_TASK_IS_PROCESSED(task)) {
		if (task->err) {
			rspamd_controller_send_error(conn_ent, task->err->code, "%s",
										 task->err->message);
		}
		else {
			const char *learn_class = rspamd_task_get_autolearn_class(task);
			msg_info_task("<%s> learned message as %s: %s",
						  rspamd_inet_address_to_string(session->from_addr),
						  learn_class ? learn_class : (session->is_spam ? "spam" : "ham"),
						  MESSAGE_FIELD_CHECK(task, message_id));
			rspamd_controller_send_string(conn_ent, "{\"success\":true}");
		}

		return TRUE;
	}

	/* One more iteration */
	return FALSE;
}

static void
rspamd_controller_scan_reply(struct rspamd_task *task)
{
	struct rspamd_http_message *msg;
	struct rspamd_http_connection_entry *conn_ent;
	int out_type = UCL_EMIT_JSON_COMPACT;
	const char *ctype = "application/json";
	const rspamd_ftok_t *accept_hdr = rspamd_task_get_request_header(task, "Accept");

	if (accept_hdr && rspamd_substring_search(accept_hdr->begin, accept_hdr->len,
											  "application/msgpack", sizeof("application/msgpack") - 1) != -1) {
		ctype = "application/msgpack";
		out_type = UCL_EMIT_MSGPACK;
	}

	conn_ent = task->fin_arg;
	msg = rspamd_http_new_message(HTTP_RESPONSE);
	msg->date = time(NULL);
	msg->code = 200;

	if (task->cmd == CMD_CHECK_V3) {
		/* v3 returns a multipart/mixed reply; ctype carries the boundary */
		rspamd_task_set_finish_time(task);
		ctype = rspamd_protocol_http_reply_v3(msg, task);
	}
	else {
		rspamd_protocol_http_reply(msg, task, NULL, out_type);
	}

	rspamd_http_connection_reset(conn_ent->conn);
	rspamd_http_router_insert_headers(conn_ent->rt, msg);
	rspamd_http_connection_write_message(conn_ent->conn, msg, NULL,
										 ctype, conn_ent, conn_ent->rt->timeout);
	conn_ent->is_reply = TRUE;
}

static gboolean
rspamd_controller_check_fin_task(void *ud)
{
	struct rspamd_task *task = ud;
	struct rspamd_http_connection_entry *conn_ent;

	msg_debug_task("finish task");
	conn_ent = task->fin_arg;

	if (task->err) {
		msg_info_task("cannot check <%s>: %e",
					  MESSAGE_FIELD_CHECK(task, message_id), task->err);
		rspamd_controller_send_error(conn_ent, task->err->code, "%s",
									 task->err->message);
		return TRUE;
	}

	if (RSPAMD_TASK_IS_PROCESSED(task)) {
		rspamd_controller_scan_reply(task);
		return TRUE;
	}

	if (!rspamd_task_process(task, RSPAMD_TASK_PROCESS_ALL)) {
		rspamd_controller_scan_reply(task);
		return TRUE;
	}

	if (RSPAMD_TASK_IS_PROCESSED(task)) {
		rspamd_controller_scan_reply(task);
		return TRUE;
	}

	/* One more iteration */
	return FALSE;
}

static int
rspamd_controller_handle_learn_common(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg,
	gboolean is_spam)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_task *task;
	const rspamd_ftok_t *cl_header;
	const char *class_name;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	if (rspamd_http_message_get_body(msg, NULL) == NULL) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   session->ctx->lang_det, ctx->event_loop, FALSE);

	task->resolver = ctx->resolver;
	/* Manual learn: ensure errors are propagated (not auto-learn semantics) */
	task->flags &= ~RSPAMD_TASK_FLAG_LEARN_AUTO;
	task->s = rspamd_task_create_session(task, session->pool,
										 rspamd_controller_learn_fin_task,
										 NULL,
										 (event_finalizer_t) rspamd_task_free);
	task->fin_arg = conn_ent;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = -1;
	session->task = task;
	rspamd_controller_task_set_transport(session, task);

	cl_header = rspamd_http_message_find_header(msg, "classifier");
	if (cl_header) {
		session->classifier = rspamd_mempool_ftokdup(session->pool, cl_header);
		task->classifier = session->classifier;
	}
	else {
		session->classifier = NULL;
	}

	if (!rspamd_task_load_message(task, msg, msg->body_buf.begin, msg->body_buf.len)) {
		goto end;
	}

	/* Use unified class-based learning approach */
	class_name = is_spam ? "spam" : "ham";
	rspamd_task_set_autolearn_class(task, class_name);

	if (!rspamd_task_process(task, RSPAMD_TASK_PROCESS_LEARN)) {
		msg_warn_session("<%s> message cannot be processed",
						 MESSAGE_FIELD_CHECK(task, message_id));
		goto end;
	}

end:
	session->is_spam = is_spam;
	rspamd_session_pending(task->s);

	return 0;
}

/*
 * Learn spam command handler:
 * request: /learnspam
 * headers: Password
 * input: plaintext data
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_learnspam(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	return rspamd_controller_handle_learn_common(conn_ent, msg, TRUE);
}
/*
 * Learn ham command handler:
 * request: /learnham
 * headers: Password
 * input: plaintext data
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_learnham(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	return rspamd_controller_handle_learn_common(conn_ent, msg, FALSE);
}

/*
 * Learn class command handler:
 * request: /learnclass
 * headers: Password, Class
 * input: plaintext data
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_learnclass(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_task *task;
	const rspamd_ftok_t *cl_header, *class_header;
	char *class_name = NULL;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	if (rspamd_http_message_get_body(msg, NULL) == NULL) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	class_header = rspamd_http_message_find_header(msg, "Class");
	if (!class_header) {
		msg_err_session("missing Class header for multiclass learning");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Class header is required for multiclass learning");
		return 0;
	}

	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   session->ctx->lang_det, ctx->event_loop, FALSE);

	task->resolver = ctx->resolver;
	/* Manual learn: ensure errors are propagated (not auto-learn semantics) */
	task->flags &= ~RSPAMD_TASK_FLAG_LEARN_AUTO;
	task->s = rspamd_task_create_session(task, session->pool,
										 rspamd_controller_learn_fin_task,
										 NULL,
										 (event_finalizer_t) rspamd_task_free);
	task->fin_arg = conn_ent;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = -1;
	session->task = task;
	rspamd_controller_task_set_transport(session, task);

	cl_header = rspamd_http_message_find_header(msg, "classifier");
	if (cl_header) {
		session->classifier = rspamd_mempool_ftokdup(session->pool, cl_header);
		task->classifier = session->classifier;
	}
	else {
		session->classifier = NULL;
	}

	if (!rspamd_task_load_message(task, msg, msg->body_buf.begin, msg->body_buf.len)) {
		goto end;
	}

	/* Set multiclass learning flag and store class name */
	class_name = rspamd_mempool_ftokdup(task->task_pool, class_header);
	rspamd_task_set_autolearn_class(task, class_name);

	if (!rspamd_task_process(task, RSPAMD_TASK_PROCESS_LEARN)) {
		msg_warn_session("<%s> message cannot be processed",
						 MESSAGE_FIELD_CHECK(task, message_id));
		goto end;
	}

end:
	/* Set session spam flag for logging compatibility */
	if (class_name) {
		session->is_spam = (strcmp(class_name, "spam") == 0);
	}
	else {
		session->is_spam = FALSE;
	}
	rspamd_session_pending(task->s);

	return 0;
}

/*
 * Scan command handler:
 * request: /scan
 * headers: Password
 * input: plaintext data
 * reply: json {scan data} or {"error":"error message"}
 */
static int
rspamd_controller_handle_scan(struct rspamd_http_connection_entry *conn_ent,
							  struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_task *task;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   ctx->lang_det, ctx->event_loop, FALSE);

	task->resolver = ctx->resolver;
	task->s = rspamd_task_create_session(task, session->pool,
										 rspamd_controller_check_fin_task,
										 NULL,
										 (event_finalizer_t) rspamd_task_free);
	task->fin_arg = conn_ent;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = conn_ent->conn->fd;
	task->flags |= RSPAMD_TASK_FLAG_MIME;
	task->resolver = ctx->resolver;
	/*
	 * Before the request is parsed: the v3 handler below can map a shm segment
	 * on its own, without going through rspamd_task_load_message
	 */
	rspamd_controller_task_set_transport(session, task);

	if (!rspamd_protocol_handle_request(task, msg)) {
		task->flags |= RSPAMD_TASK_FLAG_SKIP;
		goto end;
	}

	if (task->cmd == CMD_CHECK_V3) {
		/* checkv3 carries metadata + message inside a multipart/form-data body */
		if (!rspamd_protocol_handle_v3_request(task, msg,
											   msg->body_buf.begin,
											   msg->body_buf.len)) {
			goto end;
		}
	}
	else if (!rspamd_task_load_message(task, msg, msg->body_buf.begin, msg->body_buf.len)) {
		goto end;
	}

	if (!rspamd_task_process(task, RSPAMD_TASK_PROCESS_ALL)) {
		goto end;
	}

	if (!isnan(ctx->task_timeout) && ctx->task_timeout > 0.0) {
		task->timeout_ev.data = task;
		ev_timer_init(&task->timeout_ev, rspamd_task_timeout,
					  ctx->task_timeout, ctx->task_timeout);
		ev_timer_start(task->event_loop, &task->timeout_ev);
		ev_set_priority(&task->timeout_ev, EV_MAXPRI);
	}

end:
	session->task = task;
	rspamd_session_pending(task->s);

	return 0;
}

/*
 * Save actions command handler:
 * request: /saveactions
 * headers: Password
 * input: json array [<spam>,<probable spam>,<greylist>]
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_saveactions(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct ucl_parser *parser;
	ucl_object_t *obj;
	const ucl_object_t *cur;
	struct rspamd_controller_worker_ctx *ctx;
	const char *error;
	double score;
	int i, added = 0;
	enum rspamd_action_type act;
	ucl_object_iter_t it = NULL;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	if (rspamd_http_message_get_body(msg, NULL) == NULL) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	parser = ucl_parser_new(UCL_PARSER_SAFE_FLAGS);
	if (!ucl_parser_add_chunk(parser, msg->body_buf.begin, msg->body_buf.len)) {
		if ((error = ucl_parser_get_error(parser)) != NULL) {
			msg_err_session("cannot parse input: %s", error);
			rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
			ucl_parser_free(parser);
			return 0;
		}

		msg_err_session("cannot parse input: unknown error");
		rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
		ucl_parser_free(parser);
		return 0;
	}

	obj = ucl_parser_get_object(parser);
	ucl_parser_free(parser);

	if (obj->type != UCL_ARRAY || obj->len != 4) {
		msg_err_session("input is not an array of 4 elements");
		rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
		ucl_object_unref(obj);
		return 0;
	}

	it = ucl_object_iterate_new(obj);

	for (i = 0; i < 4; i++) {
		cur = ucl_object_iterate_safe(it, TRUE);

		switch (i) {
		case 0:
		default:
			act = METRIC_ACTION_REJECT;
			break;
		case 1:
			act = METRIC_ACTION_REWRITE_SUBJECT;
			break;
		case 2:
			act = METRIC_ACTION_ADD_HEADER;
			break;
		case 3:
			act = METRIC_ACTION_GREYLIST;
			break;
		}

		if (ucl_object_type(cur) == UCL_NULL) {
			/* Assume NaN */
			score = NAN;
		}
		else {
			score = ucl_object_todouble(cur);
		}

		struct rspamd_action *cfg_action = rspamd_config_get_action_by_type(ctx->cfg, act);

		if (cfg_action && ((isnan(cfg_action->threshold) != isnan(score)) ||
						   (cfg_action->threshold != score))) {
			add_dynamic_action(ctx->cfg, DEFAULT_METRIC, act, score);
			added++;
		}
		else {
			if (remove_dynamic_action(ctx->cfg, DEFAULT_METRIC, act)) {
				added++;
			}
		}
	}

	ucl_object_iterate_free(it);

	if (dump_dynamic_config(ctx->cfg)) {
		msg_info_session("<%s> modified %d actions",
						 rspamd_inet_address_to_string(session->from_addr),
						 added);

		rspamd_controller_send_string(conn_ent, "{\"success\":true}");
	}
	else {
		rspamd_controller_send_error(conn_ent, 500, "Save error");
	}

	ucl_object_unref(obj);

	return 0;
}

/*
 * Save symbols command handler:
 * request: /savesymbols
 * headers: Password
 * input: json data
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_savesymbols(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct ucl_parser *parser;
	ucl_object_t *obj;
	const ucl_object_t *cur, *jname, *jvalue;
	ucl_object_iter_t iter = NULL;
	struct rspamd_controller_worker_ctx *ctx;
	const char *error;
	double val;
	struct rspamd_symbol *sym;
	int added = 0;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	if (rspamd_http_message_get_body(msg, NULL) == NULL) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	parser = ucl_parser_new(UCL_PARSER_SAFE_FLAGS);
	if (!ucl_parser_add_chunk(parser, msg->body_buf.begin, msg->body_buf.len)) {
		if ((error = ucl_parser_get_error(parser)) != NULL) {
			msg_err_session("cannot parse input: %s", error);
			rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
			ucl_parser_free(parser);
			return 0;
		}

		msg_err_session("cannot parse input: unknown error");
		rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
		ucl_parser_free(parser);
		return 0;
	}

	obj = ucl_parser_get_object(parser);
	ucl_parser_free(parser);

	if (obj->type != UCL_ARRAY) {
		msg_err_session("input is not an array");
		rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
		ucl_object_unref(obj);
		return 0;
	}

	iter = ucl_object_iterate_new(obj);

	while ((cur = ucl_object_iterate_safe(iter, true))) {
		if (cur->type != UCL_OBJECT) {
			msg_err_session("json array data error");
			rspamd_controller_send_error(conn_ent, 400, "Cannot parse input");
			ucl_object_unref(obj);
			ucl_object_iterate_free(iter);

			return 0;
		}

		jname = ucl_object_lookup(cur, "name");
		jvalue = ucl_object_lookup(cur, "value");
		val = ucl_object_todouble(jvalue);
		sym = g_hash_table_lookup(session->cfg->symbols, ucl_object_tostring(jname));

		if (sym && fabs(*sym->weight_ptr - val) > DBL_EPSILON) {
			if (!add_dynamic_symbol(ctx->cfg, DEFAULT_METRIC,
									ucl_object_tostring(jname), val)) {
				msg_err_session("add symbol failed for %s",
								ucl_object_tostring(jname));
				rspamd_controller_send_error(conn_ent, 506,
											 "Add symbol failed");
				ucl_object_unref(obj);
				ucl_object_iterate_free(iter);

				return 0;
			}
			added++;
		}
		else if (sym && ctx->cfg->dynamic_conf) {
			if (remove_dynamic_symbol(ctx->cfg, DEFAULT_METRIC,
									  ucl_object_tostring(jname))) {
				added++;
			}
		}
	}

	ucl_object_iterate_free(iter);

	if (added > 0) {
		if (ctx->cfg->dynamic_conf) {
			if (dump_dynamic_config(ctx->cfg)) {
				msg_info_session("<%s> modified %d symbols",
								 rspamd_inet_address_to_string(session->from_addr),
								 added);

				rspamd_controller_send_string(conn_ent, "{\"success\":true}");
			}
			else {
				rspamd_controller_send_error(conn_ent, 500, "Save error");
			}
		}
		else {
			rspamd_controller_send_string(conn_ent, "{\"success\":true}");
		}
	}
	else {
		msg_err_session("no symbols to save");
		rspamd_controller_send_error(conn_ent, 404, "No symbols to save");
	}

	ucl_object_unref(obj);

	return 0;
}

/*
 * Save map command handler:
 * request: /savemap
 * headers: Password, Map
 * input: plaintext data
 * reply: json {"success":true} or {"error":"error message"}
 */
static int
rspamd_controller_handle_savemap(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	GList *cur;
	struct rspamd_map *map = NULL;
	struct rspamd_map_backend *bk;
	struct rspamd_controller_worker_ctx *ctx;
	const rspamd_ftok_t *idstr;
	gulong id, i;
	gboolean found = FALSE;
	char tempname[PATH_MAX];
	int fd;

	ctx = session->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	if (rspamd_http_message_get_body(msg, NULL) == NULL) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	idstr = rspamd_http_message_find_header(msg, "Map");

	if (idstr == NULL) {
		msg_info_session("absent map id");
		rspamd_controller_send_error(conn_ent, 400, "Map id not specified");
		return 0;
	}

	if (!rspamd_strtoul(idstr->begin, idstr->len, &id)) {
		msg_info_session("invalid map id: %T", idstr);
		rspamd_controller_send_error(conn_ent, 400, "Map id is invalid");
		return 0;
	}

	/* Now let's be sure that we have map defined in configuration */
	cur = ctx->cfg->maps;
	while (cur && !found) {
		map = cur->data;

		PTR_ARRAY_FOREACH(map->backends, i, bk)
		{
			if (bk->id == id && bk->protocol == MAP_PROTO_FILE) {
				found = TRUE;
				break;
			}
		}
		cur = g_list_next(cur);
	}

	if (!found) {
		msg_info_session("map not found: %L", id);
		rspamd_controller_send_error(conn_ent, 404, "Map id not found");
		return 0;
	}

	rspamd_snprintf(tempname, sizeof(tempname), "%s.newXXXXXX", bk->uri);
	fd = g_mkstemp_full(tempname, O_WRONLY, 00644);

	if (fd == -1) {
		msg_info_session("map %s open error: %s", tempname, strerror(errno));
		rspamd_controller_send_error(conn_ent, 404,
									 "Cannot open map: %s",
									 strerror(errno));
		return 0;
	}

	if (write(fd, msg->body_buf.begin, msg->body_buf.len) == -1) {
		msg_info_session("map %s write error: %s", tempname, strerror(errno));
		unlink(tempname);
		close(fd);
		rspamd_controller_send_error(conn_ent, 500, "Map write error: %s",
									 strerror(errno));
		return 0;
	}

	/* Rename */
	if (rename(tempname, bk->uri) == -1) {
		msg_info_session("map %s rename error: %s", tempname, strerror(errno));
		unlink(tempname);
		close(fd);
		rspamd_controller_send_error(conn_ent, 500, "Map rename error: %s",
									 strerror(errno));
		return 0;
	}

	msg_info_session("<%s>, map %s saved",
					 rspamd_inet_address_to_string(session->from_addr),
					 bk->uri);
	close(fd);

	rspamd_controller_send_string(conn_ent, "{\"success\":true}");

	return 0;
}

struct rspamd_stat_cbdata {
	struct rspamd_http_connection_entry *conn_ent;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_http_message *req_msg;
	ucl_object_t *top;
	ucl_object_t *stat;
	struct rspamd_task *task;
	uint64_t learned;
};

static gboolean
rspamd_controller_stat_fin_task(void *ud)
{
	struct rspamd_stat_cbdata *cbdata = ud;
	struct rspamd_http_connection_entry *conn_ent;
	ucl_object_t *top, *ar;
	struct rspamd_fuzzy_stat_entry *entry;

	conn_ent = cbdata->conn_ent;
	top = cbdata->top;

	ucl_object_insert_key(top,
						  ucl_object_fromint(cbdata->learned), "total_learns", 0, false);

	if (cbdata->stat) {
		ucl_object_insert_key(top, cbdata->stat, "statfiles", 0, false);
	}

	GHashTable *fuzzy_elts = rspamd_mempool_get_variable(cbdata->task->task_pool, RSPAMD_MEMPOOL_FUZZY_STAT);

	if (fuzzy_elts) {
		ar = ucl_object_typed_new(UCL_OBJECT);

		GHashTableIter it;

		g_hash_table_iter_init(&it, fuzzy_elts);
		while (g_hash_table_iter_next(&it, NULL, (gpointer *) &entry)) {
			if (entry->name) {
				ucl_object_insert_key(ar, ucl_object_fromint(entry->fuzzy_cnt),
									  entry->name, 0, true);
			}
		}

		ucl_object_insert_key(top, ar, "fuzzy_hashes", 0, false);
	}

	rspamd_controller_send_ucl_negotiated(conn_ent, cbdata->req_msg, top);


	return TRUE;
}

static void
rspamd_controller_stat_cleanup_task(void *ud)
{
	struct rspamd_stat_cbdata *cbdata = ud;

	rspamd_task_free(cbdata->task);
	ucl_object_unref(cbdata->top);
	if (cbdata->req_msg) {
		rspamd_http_message_unref(cbdata->req_msg);
	}
}

/*
 * Stat command handler:
 * request: /stat (/resetstat)
 * headers: Password
 * reply: json data
 */
static int
rspamd_controller_handle_stat_common(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg,
	gboolean do_reset)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	ucl_object_t *top, *sub;
	int i;
	int64_t uptime;
	uint64_t spam = 0, ham = 0;
	rspamd_mempool_stat_t mem_st;
	struct rspamd_stat *stat, stat_copy;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_task *task;
	struct rspamd_stat_cbdata *cbdata;

	memset(&mem_st, 0, sizeof(mem_st));
	rspamd_mempool_stat(&mem_st);
	memcpy(&stat_copy, session->ctx->worker->srv->stat, sizeof(stat_copy));
	stat = &stat_copy;
	ctx = session->ctx;

	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   ctx->lang_det, ctx->event_loop, FALSE);
	task->resolver = ctx->resolver;
	cbdata = rspamd_mempool_alloc0(session->pool, sizeof(*cbdata));
	cbdata->conn_ent = conn_ent;
	cbdata->task = task;
	cbdata->ctx = ctx;
	cbdata->req_msg = rspamd_http_message_ref(msg);
	top = ucl_object_typed_new(UCL_OBJECT);
	cbdata->top = top;

	task->s = rspamd_session_create(session->pool,
									rspamd_controller_stat_fin_task,
									NULL,
									rspamd_controller_stat_cleanup_task,
									cbdata);
	task->fin_arg = cbdata;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = conn_ent->conn->fd;
	rspamd_controller_task_set_transport(session, task);

	ucl_object_insert_key(top, ucl_object_fromstring(RVERSION), "version", 0, false);
	ucl_object_insert_key(top, ucl_object_fromstring(session->ctx->cfg->checksum), "config_id", 0, false);
	uptime = ev_time() - session->ctx->srv->start_time;
	ucl_object_insert_key(top, ucl_object_fromint(uptime), "uptime", 0, false);
	ucl_object_insert_key(top, ucl_object_frombool(session->is_read_only),
						  "read_only", 0, false);
	ucl_object_insert_key(top, ucl_object_fromint(stat->messages_scanned), "scanned", 0, false);
	ucl_object_insert_key(top, ucl_object_fromint(stat->messages_learned), "learned", 0, false);

	sub = ucl_object_typed_new(UCL_OBJECT);
	for (i = METRIC_ACTION_REJECT; i <= METRIC_ACTION_NOACTION; i++) {
		ucl_object_insert_key(sub,
							  ucl_object_fromint(stat->actions_stat[i]),
							  rspamd_action_to_str(i), 0, false);
		if (i < METRIC_ACTION_GREYLIST) {
			spam += stat->actions_stat[i];
		}
		else {
			ham += stat->actions_stat[i];
		}
		if (do_reset) {
#ifndef HAVE_ATOMIC_BUILTINS
			session->ctx->worker->srv->stat->actions_stat[i] = 0;
#else
			__atomic_store_n(&session->ctx->worker->srv->stat->actions_stat[i],
							 0, __ATOMIC_RELEASE);
#endif
		}
	}
	ucl_object_insert_key(top, sub, "actions", 0, false);

	sub = ucl_object_typed_new(UCL_ARRAY);
	for (i = 0; i < MAX_AVG_TIME_SLOTS; i++) {
		ucl_array_append(sub, ucl_object_fromdouble(stat->avg_time.avg_time[i]));
	}
	ucl_object_insert_key(top, sub, "scan_times", 0, false);

	ucl_object_insert_key(top, ucl_object_fromint(spam), "spam_count", 0, false);
	ucl_object_insert_key(top, ucl_object_fromint(ham), "ham_count", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(stat->connections_count), "connections", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(stat->control_connections_count),
						  "control_connections", 0, false);


	ucl_object_insert_key(top,
						  ucl_object_fromint(mem_st.pools_allocated), "pools_allocated", 0,
						  false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(mem_st.pools_freed), "pools_freed", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(mem_st.bytes_allocated), "bytes_allocated", 0,
						  false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(
							  mem_st.chunks_allocated),
						  "chunks_allocated", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(mem_st.shared_chunks_allocated),
						  "shared_chunks_allocated", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(mem_st.chunks_freed), "chunks_freed", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(
							  mem_st.oversized_chunks),
						  "chunks_oversized", 0, false);
	ucl_object_insert_key(top,
						  ucl_object_fromint(mem_st.fragmented_size), "fragmented", 0, false);

	/*
	 * Composites statistics are available via control socket /compositesstats
	 * which aggregates data from all workers
	 */

	if (do_reset) {
		session->ctx->srv->stat->messages_scanned = 0;
		session->ctx->srv->stat->messages_learned = 0;
		session->ctx->srv->stat->connections_count = 0;
		session->ctx->srv->stat->control_connections_count = 0;
		rspamd_mempool_stat_reset();
	}

	fuzzy_stat_command(task);

	/* Now write statistics for each statfile */
	rspamd_stat_statistics(task, session->ctx->cfg, &cbdata->learned,
						   &cbdata->stat);
	session->task = task;
	rspamd_session_pending(task->s);

	return 0;
}

static int
rspamd_controller_handle_stat(struct rspamd_http_connection_entry *conn_ent,
							  struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	return rspamd_controller_handle_stat_common(conn_ent, msg, FALSE);
}

static int
rspamd_controller_handle_statreset(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	if (!rspamd_controller_check_password(conn_ent, session, msg, TRUE)) {
		return 0;
	}

	msg_info_session("<%s> reset stat",
					 rspamd_inet_address_to_string(session->from_addr));
	return rspamd_controller_handle_stat_common(conn_ent, msg, TRUE);
}


/*
 * Metrics command handler:
 * request: /metrics
 * headers: Password
 * reply: OpenMetrics
 */
static gboolean
rspamd_controller_metrics_fin_task(void *ud)
{
	struct rspamd_stat_cbdata *cbdata = ud;
	struct rspamd_http_connection_entry *conn_ent;
	struct rspamd_fuzzy_stat_entry *entry;
	rspamd_fstring_t *output;

	conn_ent = cbdata->conn_ent;
	output = rspamd_metrics_to_prometheus_string(cbdata->top);

	if (cbdata->stat) {
		const ucl_object_t *cur_elt;
		ucl_object_iter_t it = NULL;
		rspamd_fstring_t *revision;
		rspamd_fstring_t *used;
		rspamd_fstring_t *total;
		rspamd_fstring_t *size;
		rspamd_fstring_t *languages;
		rspamd_fstring_t *users;

		revision = rspamd_fstring_sized_new(16);
		used = rspamd_fstring_sized_new(16);
		total = rspamd_fstring_sized_new(16);
		size = rspamd_fstring_sized_new(16);
		languages = rspamd_fstring_sized_new(16);
		users = rspamd_fstring_sized_new(16);

		while ((cur_elt = ucl_object_iterate(cbdata->stat, &it, true))) {
			const char *sym = ucl_object_tostring(ucl_object_lookup(cur_elt, "symbol"));
			const char *type = ucl_object_tostring(ucl_object_lookup(cur_elt, "type"));

			if (sym && type) {
				rspamd_printf_fstring(&revision, "rspamd_statfiles_revision{symbol=\"%s\",type=\"%s\"} %L\n",
									  sym,
									  type,
									  ucl_object_toint(ucl_object_lookup(cur_elt, "revision")));
				rspamd_printf_fstring(&used, "rspamd_statfiles_used{symbol=\"%s\",type=\"%s\"} %L\n",
									  sym,
									  type,
									  ucl_object_toint(ucl_object_lookup(cur_elt, "used")));
				rspamd_printf_fstring(&total, "rspamd_statfiles_totals{symbol=\"%s\",type=\"%s\"} %L\n",
									  sym,
									  type,
									  ucl_object_toint(ucl_object_lookup(cur_elt, "total")));
				rspamd_printf_fstring(&size, "rspamd_statfiles_size{symbol=\"%s\",type=\"%s\"} %L\n",
									  sym,
									  type,
									  ucl_object_toint(ucl_object_lookup(cur_elt, "size")));
				rspamd_printf_fstring(&languages, "rspamd_statfiles_languages{symbol=\"%s\",type=\"%s\"} %L\n",
									  sym,
									  type,
									  ucl_object_toint(ucl_object_lookup(cur_elt, "languages")));
				rspamd_printf_fstring(&users, "rspamd_statfiles_users{symbol=\"%s\",type=\"%s\"} %L\n",
									  sym,
									  type,
									  ucl_object_toint(ucl_object_lookup(cur_elt, "users")));
			}
		}

		if (RSPAMD_FSTRING_LEN(revision) > 0) {
			rspamd_printf_fstring(&output, "# HELP rspamd_statfiles_revision Stat files revision.\n");
			rspamd_printf_fstring(&output, "# TYPE rspamd_statfiles_revision gauge\n");
			output = rspamd_fstring_append(output,
										   RSPAMD_FSTRING_DATA(revision), RSPAMD_FSTRING_LEN(revision));
		}
		if (RSPAMD_FSTRING_LEN(used) > 0) {
			rspamd_printf_fstring(&output, "# HELP rspamd_statfiles_used Stat files used.\n");
			rspamd_printf_fstring(&output, "# TYPE rspamd_statfiles_used gauge\n");
			output = rspamd_fstring_append(output,
										   RSPAMD_FSTRING_DATA(used), RSPAMD_FSTRING_LEN(used));
		}
		if (RSPAMD_FSTRING_LEN(total) > 0) {
			rspamd_printf_fstring(&output, "# HELP rspamd_statfiles_totals Stat files total.\n");
			rspamd_printf_fstring(&output, "# TYPE rspamd_statfiles_totals gauge\n");
			output = rspamd_fstring_append(output,
										   RSPAMD_FSTRING_DATA(total), RSPAMD_FSTRING_LEN(total));
		}
		if (RSPAMD_FSTRING_LEN(size) > 0) {
			rspamd_printf_fstring(&output, "# HELP rspamd_statfiles_size Stat files size.\n");
			rspamd_printf_fstring(&output, "# TYPE rspamd_statfiles_size gauge\n");
			output = rspamd_fstring_append(output,
										   RSPAMD_FSTRING_DATA(size), RSPAMD_FSTRING_LEN(size));
		}
		if (RSPAMD_FSTRING_LEN(languages) > 0) {
			rspamd_printf_fstring(&output, "# HELP rspamd_statfiles_languages Stat files languages.\n");
			rspamd_printf_fstring(&output, "# TYPE rspamd_statfiles_languages gauge\n");
			output = rspamd_fstring_append(output,
										   RSPAMD_FSTRING_DATA(languages), RSPAMD_FSTRING_LEN(languages));
		}
		if (RSPAMD_FSTRING_LEN(users) > 0) {
			rspamd_printf_fstring(&output, "# HELP rspamd_statfiles_users Stat files users.\n");
			rspamd_printf_fstring(&output, "# TYPE rspamd_statfiles_users gauge\n");
			output = rspamd_fstring_append(output,
										   RSPAMD_FSTRING_DATA(users), RSPAMD_FSTRING_LEN(users));
		}

		rspamd_fstring_free(revision);
		rspamd_fstring_free(used);
		rspamd_fstring_free(total);
		rspamd_fstring_free(size);
		rspamd_fstring_free(languages);
		rspamd_fstring_free(users);
	}

	GHashTable *fuzzy_elts = rspamd_mempool_get_variable(cbdata->task->task_pool, RSPAMD_MEMPOOL_FUZZY_STAT);

	if (fuzzy_elts) {
		rspamd_printf_fstring(&output, "# HELP rspamd_fuzzy_stat Fuzzy stat labelled by storage.\n");
		rspamd_printf_fstring(&output, "# TYPE rspamd_fuzzy_stat gauge\n");

		GHashTableIter it;

		g_hash_table_iter_init(&it, fuzzy_elts);
		while (g_hash_table_iter_next(&it, NULL, (gpointer *) &entry)) {
			if (entry->name) {
				rspamd_printf_fstring(&output, "rspamd_fuzzy_stat{storage=\"%s\"} %uL\n",
									  entry->name, entry->fuzzy_cnt);
			}
		}
	}

	rspamd_printf_fstring(&output, "# EOF\n");
	rspamd_controller_send_openmetrics_negotiated(conn_ent, cbdata->req_msg, output);

	return TRUE;
}

static int
rspamd_controller_handle_metrics_common(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg,
	gboolean do_reset)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	ucl_object_t *top;
	ev_tstamp uptime;
	struct rspamd_stat stat_copy;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_task *task;
	struct rspamd_stat_cbdata *cbdata;

	uptime = ev_time() - session->ctx->srv->start_time;
	ctx = session->ctx;
	memcpy(&stat_copy, session->ctx->worker->srv->stat, sizeof(stat_copy));

	top = rspamd_worker_metrics_object(session->ctx->cfg, &stat_copy, uptime);
	ucl_object_insert_key(top, ucl_object_fromint(session->ctx->srv->start_time), "start_time", 0, false);
	ucl_object_insert_key(top, ucl_object_frombool(session->is_read_only),
						  "read_only", 0, false);
	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   ctx->lang_det, ctx->event_loop, FALSE);
	task->resolver = ctx->resolver;
	cbdata = rspamd_mempool_alloc0(session->pool, sizeof(*cbdata));
	cbdata->conn_ent = conn_ent;
	cbdata->task = task;
	cbdata->ctx = ctx;
	cbdata->top = top;
	cbdata->req_msg = rspamd_http_message_ref(msg);

	task->s = rspamd_session_create(session->pool,
									rspamd_controller_metrics_fin_task,
									NULL,
									rspamd_controller_stat_cleanup_task,
									cbdata);
	task->fin_arg = cbdata;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = conn_ent->conn->fd;
	rspamd_controller_task_set_transport(session, task);

	if (stat_copy.messages_scanned > 0 && do_reset) {
		for (int i = METRIC_ACTION_REJECT; i <= METRIC_ACTION_NOACTION; i++) {

#ifndef HAVE_ATOMIC_BUILTINS
			session->ctx->worker->srv->stat->actions_stat[i] = 0;
#else
			__atomic_store_n(&session->ctx->worker->srv->stat->actions_stat[i],
							 0, __ATOMIC_RELEASE);
#endif
		}
	}

	if (do_reset) {
		session->ctx->srv->stat->messages_scanned = 0;
		session->ctx->srv->stat->messages_learned = 0;
		session->ctx->srv->stat->connections_count = 0;
		session->ctx->srv->stat->control_connections_count = 0;
		rspamd_mempool_stat_reset();
	}

	fuzzy_stat_command(task);

	/* Now write statistics for each statfile */
	rspamd_stat_statistics(task, session->ctx->cfg, &cbdata->learned,
						   &cbdata->stat);
	session->task = task;
	rspamd_session_pending(task->s);


	return 0;
}


static int
rspamd_controller_handle_metrics(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}
	return rspamd_controller_handle_metrics_common(conn_ent, msg, FALSE);
}


/*
 * Counters command handler:
 * request: /counters
 * headers: Password
 * reply: json array of all counters
 */
static int
rspamd_controller_handle_counters(
	struct rspamd_http_connection_entry *conn_ent,
	struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	ucl_object_t *top;
	struct rspamd_symcache *cache;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	cache = session->ctx->cfg->cache;

	if (cache != NULL) {
		top = rspamd_symcache_counters(cache);
		rspamd_controller_send_ucl(conn_ent, top);
		ucl_object_unref(top);
	}
	else {
		rspamd_controller_send_error(conn_ent, 500, "Invalid cache");
	}

	return 0;
}

static int
rspamd_controller_handle_custom(struct rspamd_http_connection_entry *conn_ent,
								struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_custom_controller_command *cmd;
	char *url_str;
	struct http_parser_url u;
	rspamd_ftok_t lookup;

	http_parser_parse_url(msg->url->str, msg->url->len, TRUE, &u);

	if (u.field_set & (1 << UF_PATH)) {
		gsize unnorm_len;
		lookup.begin = msg->url->str + u.field_data[UF_PATH].off;
		lookup.len = u.field_data[UF_PATH].len;

		rspamd_normalize_path_inplace((char *) lookup.begin,
									  lookup.len,
									  &unnorm_len);
		lookup.len = unnorm_len;
	}
	else {
		lookup.begin = msg->url->str;
		lookup.len = msg->url->len;
	}

	url_str = rspamd_ftok_cstr(&lookup);
	cmd = g_hash_table_lookup(session->ctx->custom_commands, url_str);
	g_free(url_str);

	if (cmd == NULL || cmd->handler == NULL) {
		msg_err_session("custom command %T has not been found", &lookup);
		rspamd_controller_send_error(conn_ent, 404, "No command associated");
		return 0;
	}

	if (!rspamd_controller_check_password(conn_ent, session, msg,
										  cmd->privileged)) {
		return 0;
	}
	if (cmd->require_message && (rspamd_http_message_get_body(msg, NULL) == NULL)) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	/* Transfer query arguments to headers */
	if (u.field_set & (1u << UF_QUERY)) {
		GHashTable *query_args;
		GHashTableIter it;
		gpointer k, v;
		rspamd_ftok_t *key, *value;

		/* In case if we have a query, we need to store it somewhere */
		query_args = rspamd_http_message_parse_query(msg);

		/* Insert the rest of query params as HTTP headers */
		g_hash_table_iter_init(&it, query_args);

		while (g_hash_table_iter_next(&it, &k, &v)) {
			key = k;
			value = v;
			/* Steal strings */
			g_hash_table_iter_steal(&it);
			url_str = rspamd_ftok_cstr(key);
			rspamd_http_message_add_header_len(msg, url_str,
											   value->begin, value->len);
			g_free(url_str);
		}

		g_hash_table_unref(query_args);
	}

	return cmd->handler(conn_ent, msg, cmd->ctx);
}

static int
rspamd_controller_handle_plugins(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_plugin_cbdata *cbd;
	GHashTableIter it;
	gpointer k, v;
	ucl_object_t *plugins;

	if (!rspamd_controller_check_password(conn_ent, session, msg,
										  FALSE)) {
		return 0;
	}

	plugins = ucl_object_typed_new(UCL_OBJECT);
	g_hash_table_iter_init(&it, session->ctx->plugins);

	while (g_hash_table_iter_next(&it, &k, &v)) {
		ucl_object_t *elt, *npath;

		cbd = v;
		elt = (ucl_object_t *) ucl_object_lookup(plugins, cbd->plugin);

		if (elt == NULL) {
			elt = ucl_object_typed_new(UCL_OBJECT);
			ucl_object_insert_key(elt, ucl_object_fromint(cbd->version),
								  "version", 0, false);
			npath = ucl_object_typed_new(UCL_ARRAY);
			ucl_object_insert_key(elt, npath, "paths", 0, false);
			ucl_object_insert_key(plugins, elt, cbd->plugin, 0, false);
		}
		else {
			npath = (ucl_object_t *) ucl_object_lookup(elt, "paths");
		}

		g_assert(npath != NULL);
		rspamd_ftok_t *key_tok = (rspamd_ftok_t *) k;
		ucl_array_append(npath, ucl_object_fromlstring(key_tok->begin, key_tok->len));
	}

	rspamd_controller_send_ucl(conn_ent, plugins);
	ucl_object_unref(plugins);

	return 0;
}

static int
rspamd_controller_handle_ping(struct rspamd_http_connection_entry *conn_ent,
							  struct rspamd_http_message *msg)
{
	struct rspamd_http_message *rep_msg;
	rspamd_fstring_t *reply;

	rep_msg = rspamd_http_new_message(HTTP_RESPONSE);
	rep_msg->date = time(NULL);
	rep_msg->code = 200;
	rep_msg->status = rspamd_fstring_new_init("OK", 2);
	reply = rspamd_fstring_new_init("pong" CRLF, strlen("pong" CRLF));
	rspamd_http_message_set_body_from_fstring_steal(rep_msg, reply);
	rspamd_http_connection_reset(conn_ent->conn);
	rspamd_http_router_insert_headers(conn_ent->rt, rep_msg);
	rspamd_http_connection_write_message(conn_ent->conn,
										 rep_msg,
										 NULL,
										 "text/plain",
										 conn_ent,
										 conn_ent->rt->timeout);
	conn_ent->is_reply = TRUE;

	return 0;
}

/*
 * Called on unknown methods and is used to deal with CORS as per
 * https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
 */
static int
rspamd_controller_handle_unknown(struct rspamd_http_connection_entry *conn_ent,
								 struct rspamd_http_message *msg)
{
	struct rspamd_http_message *rep;

	if (msg->method == HTTP_OPTIONS) {
		/* Assume CORS request */

		rep = rspamd_http_new_message(HTTP_RESPONSE);
		rep->date = time(NULL);
		rep->code = 200;
		rep->status = rspamd_fstring_new_init("OK", 2);
		rspamd_http_message_add_header(rep, "Access-Control-Allow-Methods",
									   "POST, GET, OPTIONS");
		rspamd_http_message_add_header(rep, "Access-Control-Allow-Headers",
									   "Classifier,Class,Content-Type,Password,Map,Weight,Flag,Hash");
		rspamd_http_connection_reset(conn_ent->conn);
		rspamd_http_router_insert_headers(conn_ent->rt, rep);
		rspamd_http_connection_write_message(conn_ent->conn,
											 rep,
											 NULL,
											 "text/plain",
											 conn_ent,
											 conn_ent->rt->timeout);
		conn_ent->is_reply = TRUE;
	}
	else {
		rep = rspamd_http_new_message(HTTP_RESPONSE);
		rep->date = time(NULL);
		rep->code = 500;
		rep->status = rspamd_fstring_new_init("Invalid method",
											  strlen("Invalid method"));
		rspamd_http_connection_reset(conn_ent->conn);
		rspamd_http_router_insert_headers(conn_ent->rt, rep);
		rspamd_http_connection_write_message(conn_ent->conn,
											 rep,
											 NULL,
											 "text/plain",
											 conn_ent,
											 conn_ent->rt->timeout);
		conn_ent->is_reply = TRUE;
	}

	return 0;
}

static int
rspamd_controller_handle_lua_plugin(struct rspamd_http_connection_entry *conn_ent,
									struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_plugin_cbdata *cbd;
	struct rspamd_task *task, **ptask;
	struct rspamd_http_connection_entry **pconn;
	struct rspamd_controller_worker_ctx *ctx;
	lua_State *L;
	struct http_parser_url u;
	rspamd_ftok_t lookup;


	http_parser_parse_url(msg->url->str, msg->url->len, TRUE, &u);

	if (u.field_set & (1 << UF_PATH)) {
		gsize unnorm_len;
		lookup.begin = msg->url->str + u.field_data[UF_PATH].off;
		lookup.len = u.field_data[UF_PATH].len;

		rspamd_normalize_path_inplace((char *) lookup.begin,
									  lookup.len,
									  &unnorm_len);
		lookup.len = unnorm_len;
	}
	else {
		lookup.begin = msg->url->str;
		lookup.len = msg->url->len;
	}

	cbd = g_hash_table_lookup(session->ctx->plugins, &lookup);

	if (cbd == NULL || cbd->handler == NULL) {
		msg_err_session("plugin handler %T has not been found", &lookup);
		rspamd_controller_send_error(conn_ent, 404, "No command associated");
		return 0;
	}

	L = cbd->L;
	ctx = cbd->ctx;

	if (!rspamd_controller_check_password(conn_ent, session, msg,
										  cbd->is_enable)) {
		return 0;
	}
	if (cbd->need_task && (rspamd_http_message_get_body(msg, NULL) == NULL)) {
		msg_err_session("got zero length body, cannot continue");
		rspamd_controller_send_error(conn_ent,
									 400,
									 "Empty body is not permitted");
		return 0;
	}

	task = rspamd_task_new(session->ctx->worker, session->cfg, session->pool,
						   ctx->lang_det, ctx->event_loop, FALSE);

	task->resolver = ctx->resolver;
	task->s = rspamd_task_create_session(task, session->pool,
										 rspamd_controller_lua_fin_task,
										 NULL,
										 (event_finalizer_t) rspamd_task_free);
	task->fin_arg = conn_ent;
	task->http_conn = rspamd_http_connection_ref(conn_ent->conn);
	task->sock = -1;
	session->task = task;
	rspamd_controller_task_set_transport(session, task);

	if (msg->body_buf.len > 0) {
		if (!rspamd_task_load_message(task, msg, msg->body_buf.begin, msg->body_buf.len)) {
			rspamd_controller_send_error(conn_ent, task->err->code, "%s",
										 task->err->message);
			return 0;
		}
	}

	/* Callback */
	lua_rawgeti(L, LUA_REGISTRYINDEX, cbd->handler->idx);

	/* Task */
	ptask = lua_newuserdata(L, sizeof(*ptask));
	rspamd_lua_setclass(L, rspamd_task_classname, -1);
	*ptask = task;

	/* Connection */
	pconn = lua_newuserdata(L, sizeof(*pconn));
	rspamd_lua_setclass(L, rspamd_csession_classname, -1);
	*pconn = conn_ent;

	/* Query arguments */
	GHashTable *params;
	GHashTableIter it;
	gpointer k, v;

	params = rspamd_http_message_parse_query(msg);
	lua_createtable(L, g_hash_table_size(params), 0);
	g_hash_table_iter_init(&it, params);

	while (g_hash_table_iter_next(&it, &k, &v)) {
		rspamd_ftok_t *key_tok = (rspamd_ftok_t *) k,
					  *value_tok = (rspamd_ftok_t *) v;

		lua_pushlstring(L, key_tok->begin, key_tok->len);
		/* TODO: consider rspamd_text here */
		lua_pushlstring(L, value_tok->begin, value_tok->len);
		lua_settable(L, -3);
	}

	g_hash_table_unref(params);

	if (lua_pcall(L, 3, 0, 0) != 0) {
		rspamd_controller_send_error(conn_ent, 503, "Cannot run callback: %s",
									 lua_tostring(L, -1));
		lua_settop(L, 0);

		return 0;
	}

	rspamd_session_pending(task->s);

	return 0;
}

/*
 * Bayes classifier list command handler:
 * request: /bayes/classifiers
 * headers: Password
 * reply: JSON object with classifiers array containing metadata:
 *   {classifiers: [{name, type, per_user, classes: [...]}, ...]}
 *   Classifiers are listed in declaration order from config.
 */
static int
rspamd_controller_handle_bayes_classifiers(struct rspamd_http_connection_entry *conn_ent,
										   struct rspamd_http_message *msg)
{
	struct rspamd_controller_session *session = conn_ent->ud;
	struct rspamd_controller_worker_ctx *ctx = session->ctx;
	ucl_object_t *result, *classifiers_array, *classifier_obj, *classes_array;
	struct rspamd_classifier_config *clc;
	GList *cur, *st_cur;

	if (!rspamd_controller_check_password(conn_ent, session, msg, FALSE)) {
		return 0;
	}

	result = ucl_object_typed_new(UCL_OBJECT);
	classifiers_array = ucl_object_typed_new(UCL_ARRAY);

	/*
	 * Iterate backwards to compensate for g_list_prepend() in config parser,
	 * returning classifiers in declaration order from config file.
	 */
	cur = g_list_last(ctx->cfg->classifiers);
	while (cur) {
		clc = cur->data;

		classifier_obj = ucl_object_typed_new(UCL_OBJECT);
		ucl_object_insert_key(classifier_obj,
							  ucl_object_fromstring(clc->name),
							  "name", 0, false);
		ucl_object_insert_key(classifier_obj,
							  ucl_object_fromstring(rspamd_classifier_type(clc)),
							  "type", 0, false);
		ucl_object_insert_key(classifier_obj,
							  ucl_object_frombool(rspamd_classifier_is_per_user(clc)),
							  "per_user", 0, false);

		/* Collect unique class names from statfiles.
		 * Linear search is used since N < 10 in practice, avoiding hash table overhead. */
		classes_array = ucl_object_typed_new(UCL_ARRAY);

		st_cur = clc->statfiles;
		while (st_cur) {
			struct rspamd_statfile_config *stcf = st_cur->data;
			if (stcf->class_name) {
				gboolean seen = FALSE;
				ucl_object_iter_t it = NULL;
				const ucl_object_t *item;

				while ((item = ucl_object_iterate(classes_array, &it, true)) != NULL) {
					if (strcmp(ucl_object_tostring(item), stcf->class_name) == 0) {
						seen = TRUE;
						break;
					}
				}
				if (!seen) {
					ucl_array_append(classes_array, ucl_object_fromstring(stcf->class_name));
				}
			}
			st_cur = g_list_next(st_cur);
		}

		ucl_object_insert_key(classifier_obj, classes_array, "classes", 0, false);
		ucl_array_append(classifiers_array, classifier_obj);

		cur = g_list_previous(cur);
	}

	ucl_object_insert_key(result, classifiers_array, "classifiers", 0, false);

	rspamd_controller_send_ucl(conn_ent, result);
	ucl_object_unref(result);
	return 0;
}


static void
rspamd_controller_error_handler(struct rspamd_http_connection_entry *conn_ent,
								GError *err)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	msg_err_session("http error occurred: %s", err->message);
}

/*
 * Pending connections accounting per source address. The global limit alone
 * would let a single peer occupy the whole budget of the worker, so in-flight
 * connections are also counted per source. Entries are dropped as soon as a
 * source has no connection left, which bounds the table by the number of peers
 * that are actually connected right now.
 *
 * Returns FALSE when the source is already at its limit; the caller must then
 * not create a session (nothing has been accounted in that case).
 */
static gboolean
rspamd_controller_source_conn_add(struct rspamd_controller_worker_ctx *ctx,
								  const rspamd_inet_addr_t *addr)
{
	unsigned int *nconns;

	if (ctx->conns_per_source == NULL || ctx->max_connections_per_source == 0 ||
		addr == NULL || rspamd_inet_address_get_af(addr) == AF_UNIX) {
		/* Disabled, or a local peer that is not subject to the limit */
		return TRUE;
	}

	nconns = g_hash_table_lookup(ctx->conns_per_source, addr);

	if (nconns != NULL) {
		if (*nconns >= ctx->max_connections_per_source) {
			return FALSE;
		}

		(*nconns)++;
	}
	else {
		nconns = g_malloc(sizeof(*nconns));
		*nconns = 1;
		g_hash_table_insert(ctx->conns_per_source,
							rspamd_inet_address_copy(addr, NULL),
							nconns);
	}

	return TRUE;
}

/*
 * Releases one pending connection of a source. Mirrors
 * `rspamd_controller_source_conn_add` and must be called exactly once for every
 * successful call of it.
 */
static void
rspamd_controller_source_conn_remove(struct rspamd_controller_worker_ctx *ctx,
									 const rspamd_inet_addr_t *addr)
{
	unsigned int *nconns;

	if (ctx->conns_per_source == NULL || ctx->max_connections_per_source == 0 ||
		addr == NULL || rspamd_inet_address_get_af(addr) == AF_UNIX) {
		return;
	}

	nconns = g_hash_table_lookup(ctx->conns_per_source, addr);

	if (nconns == NULL) {
		return;
	}

	if (*nconns > 1) {
		(*nconns)--;
	}
	else {
		g_hash_table_remove(ctx->conns_per_source, addr);
	}
}

static void
rspamd_controller_finish_handler(struct rspamd_http_connection_entry *conn_ent)
{
	struct rspamd_controller_session *session = conn_ent->ud;

	session->ctx->worker->srv->stat->control_connections_count++;

	if (session->task != NULL) {
		rspamd_session_destroy(session->task->s);
	}

	session->wrk->nconns--;
	rspamd_controller_source_conn_remove(session->ctx, session->from_addr);
	rspamd_inet_address_free(session->from_addr);
	CFG_REF_RELEASE(session->cfg);

	if (session->pool) {
		msg_debug_session("destroy session %p", session);
		rspamd_mempool_delete(session->pool);
	}

	g_free(session);
}

static void
rspamd_controller_accept_socket(EV_P_ ev_io *w, int revents)
{
	struct rspamd_worker *worker = (struct rspamd_worker *) w->data;
	struct rspamd_controller_worker_ctx *ctx;
	struct rspamd_controller_session *session;
	rspamd_inet_addr_t *addr = NULL;
	int nfd;

	ctx = worker->ctx;

	if ((nfd =
			 rspamd_accept_from_socket(w->fd, &addr,
									   rspamd_worker_throttle_accept_events, worker->accept_events)) == -1) {
		msg_warn_ctx("accept failed: %s", strerror(errno));
		return;
	}
	/* Check for EAGAIN */
	if (nfd == 0) {
		rspamd_inet_address_free(addr);
		return;
	}

	/*
	 * Admission control runs before anything is allocated for this connection:
	 * a session pool, a TLS handshake or a password KDF are all far more
	 * expensive than the accept itself, so the limits must be applied while the
	 * connection is still just a file descriptor. The connection is accepted
	 * and closed at once instead of being left in the listen queue, otherwise
	 * the level triggered accept watcher would spin on a readable listener.
	 */
	if (ctx->max_connections > 0 && worker->nconns >= ctx->max_connections) {
		msg_info_ctx("deny connection from %s: the worker already serves "
					 "%ud connections, the limit is %ud",
					 rspamd_inet_address_to_string_pretty(addr),
					 worker->nconns, ctx->max_connections);
		rspamd_inet_address_free(addr);
		close(nfd);

		return;
	}

	if (!rspamd_controller_source_conn_add(ctx, addr)) {
		msg_info_ctx("deny connection from %s: this source already has %ud "
					 "pending connections",
					 rspamd_inet_address_to_string_pretty(addr),
					 ctx->max_connections_per_source);
		rspamd_inet_address_free(addr);
		close(nfd);

		return;
	}

	session = g_malloc0(sizeof(struct rspamd_controller_session));
	session->pool = rspamd_mempool_new_short_lived("csession");
	session->ctx = ctx;
	session->cfg = ctx->cfg;
	session->lang_det = ctx->lang_det;
	CFG_REF_RETAIN(session->cfg);

	session->from_addr = addr;
	session->wrk = worker;
	/* Decided once, from the transport, so that handlers in other modules
	 * (e.g. fuzzy_check) can honour it without seeing our private context */
	session->allow_file_shm_input = rspamd_controller_allow_file_shm(session);
	worker->nconns++;

	rspamd_http_router_handle_socket_ssl(ctx->http, nfd, session,
										 rspamd_worker_is_ssl_socket(worker, w->fd));
}

/*
 * Verifies that an encrypted password is complete, i.e. that it carries both a
 * salt and a key of the length expected by its own pbkdf. A password that only
 * has a valid `$id` prefix can never be verified at runtime.
 */
static gboolean
rspamd_controller_encrypted_password_is_complete(const char *password,
												 const struct rspamd_controller_pbkdf *pbkdf)
{
	const char *salt, *hash;
	char *salt_decoded, *key_decoded;
	gsize pwlen, salt_len = 0, key_len = 0;
	gboolean ret = FALSE;

	pwlen = strlen(password);
	salt = rspamd_encrypted_password_get_str(password, pwlen, 3, &salt_len);
	hash = rspamd_encrypted_password_get_str(password, pwlen,
											 3 + salt_len + 1, &key_len);

	if (salt == NULL || hash == NULL) {
		return FALSE;
	}

	salt_decoded = rspamd_decode_base32(salt, salt_len, &salt_len,
										RSPAMD_BASE32_DEFAULT);
	key_decoded = rspamd_decode_base32(hash, key_len, &key_len,
									   RSPAMD_BASE32_DEFAULT);

	if (salt_decoded != NULL && key_decoded != NULL &&
		salt_len == pbkdf->salt_len && key_len == pbkdf->key_len) {
		ret = TRUE;
	}

	g_free(salt_decoded); /* valid even if NULL */
	g_free(key_decoded);

	return ret;
}

static void
rspamd_controller_password_sane(struct rspamd_controller_worker_ctx *ctx,
								const char *password, const char *type)
{
	const struct rspamd_controller_pbkdf *pbkdf = NULL;

	if (password == NULL) {
		msg_warn_ctx("%s is not set, so you should filter controller "
					 "availability "
					 "by using of firewall or `secure_ip` option",
					 type);
		return;
	}

	if (!rspamd_is_encrypted_password(password, &pbkdf)) {
		/* Suggest encryption to a user */

		msg_warn_ctx("your %s is not encrypted, we strongly "
					 "recommend to replace it with the encrypted one",
					 type);
	}
	else if (!rspamd_controller_encrypted_password_is_complete(password, pbkdf)) {
		msg_err_ctx("your %s has a valid encryption id but is malformed: the "
					"salt and/or the key is missing or has an unexpected "
					"length; authentication will always be denied for it, "
					"please regenerate it using `rspamadm pw`",
					type);
	}
}

gpointer
init_controller_worker(struct rspamd_config *cfg)
{
	struct rspamd_controller_worker_ctx *ctx;
	GQuark type;

	type = g_quark_try_string("controller");

	ctx = rspamd_mempool_alloc0(cfg->cfg_pool,
								sizeof(struct rspamd_controller_worker_ctx));

	ctx->magic = rspamd_controller_ctx_magic;
	ctx->timeout = DEFAULT_WORKER_IO_TIMEOUT;
	ctx->task_timeout = NAN;
	ctx->max_auth_failures = DEFAULT_MAX_AUTH_FAILURES;
	ctx->auth_failure_window = DEFAULT_AUTH_FAILURE_WINDOW;
	/* Permissive for this release, see the option description below */
	ctx->allow_file_and_shm_inputs = TRUE;
	ctx->max_connections = DEFAULT_MAX_CONNECTIONS;
	ctx->max_connections_per_source = DEFAULT_MAX_CONNECTIONS_PER_SOURCE;

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "password",
									  rspamd_rcl_parse_struct_string,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx, password),
									  0,
									  "Password for read-only commands");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "enable_password",
									  rspamd_rcl_parse_struct_string,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  enable_password),
									  0,
									  "Password for read and write commands");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "ssl_cert",
									  rspamd_rcl_parse_struct_string,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx, ssl_cert),
									  0,
									  "Path to SSL certificate chain file");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "ssl_key",
									  rspamd_rcl_parse_struct_string,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx, ssl_key),
									  0,
									  "Path to SSL private key file");
	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "timeout",
									  rspamd_rcl_parse_struct_time,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  timeout),
									  RSPAMD_CL_FLAG_TIME_FLOAT,
									  "Protocol timeout");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "secure_ip",
									  rspamd_rcl_parse_struct_ucl,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx, secure_ip),
									  0,
									  "List of IP addresses that are allowed for password-less access");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "trusted_ips",
									  rspamd_rcl_parse_struct_ucl,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx, secure_ip),
									  0,
									  "List of IP addresses that are allowed for password-less access");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "static_dir",
									  rspamd_rcl_parse_struct_string,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  static_files_dir),
									  0,
									  "Directory for static files served by controller's HTTP server");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "keypair",
									  rspamd_rcl_parse_struct_keypair,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  key),
									  0,
									  "Encryption keypair");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "task_timeout",
									  rspamd_rcl_parse_struct_time,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  task_timeout),
									  RSPAMD_CL_FLAG_TIME_FLOAT,
									  "Maximum task processing time, default: 8.0 seconds");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "max_auth_failures",
									  rspamd_rcl_parse_struct_integer,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  max_auth_failures),
									  RSPAMD_CL_FLAG_INT_32 | RSPAMD_CL_FLAG_UINT,
									  "Authentication failures allowed from one source before it is "
									  "throttled, 0 disables throttling, default: 10");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "auth_failure_window",
									  rspamd_rcl_parse_struct_time,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  auth_failure_window),
									  RSPAMD_CL_FLAG_TIME_FLOAT,
									  "Time for a source to regain all of its authentication "
									  "attempts, default: 60 seconds");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "allow_file_and_shm_inputs",
									  rspamd_rcl_parse_struct_boolean,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  allow_file_and_shm_inputs),
									  0,
									  "Allow privileged File/Path/Shm message source inputs, which "
									  "make rspamd read a local file or shared memory segment named "
									  "by the client, for connections accepted over TCP; unix socket "
									  "clients are always allowed to use them. Default: true, this "
									  "will become false in the next major release");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "max_connections",
									  rspamd_rcl_parse_struct_integer,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  max_connections),
									  RSPAMD_CL_FLAG_UINT,
									  "Maximum number of connections served simultaneously by one "
									  "controller worker, further connections are closed right after "
									  "accept, 0 means unlimited, default: 0");

	rspamd_rcl_register_worker_option(cfg,
									  type,
									  "max_connections_per_source",
									  rspamd_rcl_parse_struct_integer,
									  ctx,
									  G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx,
													  max_connections_per_source),
									  RSPAMD_CL_FLAG_UINT,
									  "Maximum number of simultaneous connections from a single "
									  "source address, unix socket clients are not affected, "
									  "0 means unlimited, default: 0");

	return ctx;
}

/* Lua bindings */
LUA_FUNCTION_DEF(csession, get_ev_base);
LUA_FUNCTION_DEF(csession, get_cfg);
LUA_FUNCTION_DEF(csession, send_ucl);
LUA_FUNCTION_DEF(csession, send_string);
LUA_FUNCTION_DEF(csession, send_error);

static const struct luaL_reg lua_csessionlib_m[] = {
	LUA_INTERFACE_DEF(csession, get_ev_base),
	LUA_INTERFACE_DEF(csession, get_cfg),
	LUA_INTERFACE_DEF(csession, send_ucl),
	LUA_INTERFACE_DEF(csession, send_string),
	LUA_INTERFACE_DEF(csession, send_error),
	{"__tostring", rspamd_lua_class_tostring},
	{NULL, NULL}};

/* Basic functions of LUA API for worker object */
static void
luaopen_controller(lua_State *L)
{
	rspamd_lua_new_class(L, rspamd_csession_classname, lua_csessionlib_m);
	lua_pop(L, 1);
}

struct rspamd_http_connection_entry *
lua_check_controller_entry(lua_State *L, int pos)
{
	void *ud = rspamd_lua_check_udata(L, pos, rspamd_csession_classname);
	luaL_argcheck(L, ud != NULL, pos, "'csession' expected");
	return ud ? *((struct rspamd_http_connection_entry **) ud) : NULL;
}

static int
lua_csession_get_ev_base(lua_State *L)
{
	struct rspamd_http_connection_entry *c = lua_check_controller_entry(L, 1);
	struct ev_loop **pbase;
	struct rspamd_controller_session *s;

	if (c) {
		s = c->ud;
		pbase = lua_newuserdata(L, sizeof(struct ev_loop *));
		rspamd_lua_setclass(L, rspamd_ev_base_classname, -1);
		*pbase = s->ctx->event_loop;
	}
	else {
		return luaL_error(L, "invalid arguments");
	}

	return 1;
}

static int
lua_csession_get_cfg(lua_State *L)
{
	struct rspamd_http_connection_entry *c = lua_check_controller_entry(L, 1);
	struct rspamd_config **pcfg;
	struct rspamd_controller_session *s;

	if (c) {
		s = c->ud;
		pcfg = lua_newuserdata(L, sizeof(gpointer));
		rspamd_lua_setclass(L, rspamd_config_classname, -1);
		*pcfg = s->ctx->cfg;
	}
	else {
		return luaL_error(L, "invalid arguments");
	}

	return 1;
}

static int
lua_csession_send_ucl(lua_State *L)
{
	struct rspamd_http_connection_entry *c = lua_check_controller_entry(L, 1);
	ucl_object_t *obj = ucl_object_lua_import_escape(L, 2);

	if (c) {
		rspamd_controller_send_ucl(c, obj);
	}
	else {
		ucl_object_unref(obj);
		return luaL_error(L, "invalid arguments");
	}

	ucl_object_unref(obj);

	return 0;
}

static int
lua_csession_send_error(lua_State *L)
{
	struct rspamd_http_connection_entry *c = lua_check_controller_entry(L, 1);
	unsigned int err_code = lua_tonumber(L, 2);
	const char *err_str = lua_tostring(L, 3);

	if (c) {
		rspamd_controller_send_error(c, err_code, "%s", err_str);
	}
	else {
		return luaL_error(L, "invalid arguments");
	}

	return 0;
}

static int
lua_csession_send_string(lua_State *L)
{
	struct rspamd_http_connection_entry *c = lua_check_controller_entry(L, 1);
	const char *str = lua_tostring(L, 2);

	if (c) {
		rspamd_controller_send_string(c, str);
	}
	else {
		return luaL_error(L, "invalid arguments");
	}

	return 0;
}

static void
rspamd_plugin_cbdata_dtor(gpointer p)
{
	struct rspamd_controller_plugin_cbdata *cbd = p;

	g_free(cbd->plugin);
	ucl_object_unref(cbd->obj); /* This also releases lua references */
	g_free(cbd);
}

static void
rspamd_controller_register_plugin_path(lua_State *L,
									   struct rspamd_controller_worker_ctx *ctx,
									   const ucl_object_t *webui_data,
									   const ucl_object_t *handler,
									   const char *path,
									   const char *plugin_name)
{
	struct rspamd_controller_plugin_cbdata *cbd;
	const ucl_object_t *elt;
	rspamd_fstring_t *full_path;

	cbd = g_malloc0(sizeof(*cbd));
	cbd->L = L;
	cbd->ctx = ctx;
	cbd->handler = ucl_object_toclosure(handler);
	cbd->plugin = g_strdup(plugin_name);
	cbd->obj = ucl_object_ref(webui_data);

	elt = ucl_object_lookup(webui_data, "version");

	if (elt) {
		cbd->version = ucl_object_toint(elt);
	}

	elt = ucl_object_lookup(webui_data, "enable");

	if (elt && ucl_object_toboolean(elt)) {
		cbd->is_enable = TRUE;
	}

	elt = ucl_object_lookup(webui_data, "need_task");

	if (elt && !!ucl_object_toboolean(elt)) {
		cbd->need_task = TRUE;
	}

	full_path = rspamd_fstring_new_init("/plugins/", sizeof("/plugins/") - 1);
	/* Zero terminated */
	rspamd_printf_fstring(&full_path, "%s/%s%c",
						  plugin_name, path, '\0');

	rspamd_http_router_add_path(ctx->http,
								full_path->str,
								rspamd_controller_handle_lua_plugin);
	rspamd_ftok_t *key_tok = rspamd_ftok_map(full_path);
	/* Truncate stupid \0 symbol to enable lookup */
	key_tok->len--;
	g_hash_table_insert(ctx->plugins, key_tok, cbd);
}

static void
rspamd_controller_register_plugins_paths(struct rspamd_controller_worker_ctx *ctx)
{
	lua_State *L = ctx->cfg->lua_state;
	ucl_object_t *webui_data;
	const ucl_object_t *handler_obj, *cur;
	ucl_object_iter_t it = NULL;

	lua_getglobal(L, "rspamd_plugins");

	if (lua_istable(L, -1)) {

		for (lua_pushnil(L); lua_next(L, -2); lua_pop(L, 2)) {
			lua_pushvalue(L, -2); /* Store key */

			lua_pushstring(L, "webui");
			lua_gettable(L, -3); /* value is at -3 index */

			if (lua_istable(L, -1)) {
				webui_data = ucl_object_lua_import_escape(L, -1);

				while ((cur = ucl_object_iterate(webui_data, &it, true)) != NULL) {
					handler_obj = ucl_object_lookup(cur, "handler");

					if (handler_obj && ucl_object_key(cur)) {
						rspamd_controller_register_plugin_path(L, ctx,
															   cur, handler_obj, ucl_object_key(cur),
															   lua_tostring(L, -2));
					}
					else {
						msg_err_ctx("bad webui definition for plugin: %s",
									lua_tostring(L, -2));
					}
				}

				ucl_object_unref(webui_data);
			}

			lua_pop(L, 1); /* remove table value */
		}
	}

	lua_pop(L, 1); /* rspamd_plugins global */
}

static void
rspamd_controller_health_rep(struct rspamd_worker *worker,
							 struct rspamd_srv_reply *rep, int rep_fd,
							 gpointer ud)
{
	struct rspamd_controller_worker_ctx *ctx = (struct rspamd_controller_worker_ctx *) ud;

	ctx->workers_count = rep->reply.health.workers_count;
	ctx->scanners_count = rep->reply.health.scanners_count;
	ctx->workers_hb_lost = rep->reply.health.workers_hb_lost;

	ev_timer_again(ctx->event_loop, &ctx->health_check_timer);
}

static void
rspamd_controller_health_timer(EV_P_ ev_timer *w, int revents)
{
	struct rspamd_controller_worker_ctx *ctx = (struct rspamd_controller_worker_ctx *) w->data;
	struct rspamd_srv_command srv_cmd;

	memset(&srv_cmd, 0, sizeof(srv_cmd));
	srv_cmd.type = RSPAMD_SRV_HEALTH;
	rspamd_srv_send_command(ctx->worker, ctx->event_loop, &srv_cmd, -1,
							rspamd_controller_health_rep, ctx);
	ev_timer_stop(EV_A_ w);
}

/*
 * Start worker process
 */
__attribute__((noreturn)) void
start_controller_worker(struct rspamd_worker *worker)
{
	struct rspamd_controller_worker_ctx *ctx = worker->ctx;
	struct module_ctx *mctx;
	GHashTableIter iter;
	gpointer key, value;
	unsigned int i;
	gpointer m;

	g_assert(rspamd_worker_check_context(worker->ctx, rspamd_controller_ctx_magic));
	ctx->event_loop = rspamd_prepare_worker(worker,
											"controller",
											rspamd_controller_accept_socket);

	rspamd_worker_warn_file_shm_inputs(worker, "controller",
									   ctx->allow_file_and_shm_inputs);

	ctx->worker = worker;
	ctx->cfg = worker->srv->cfg;
	CFG_REF_RETAIN(ctx->cfg);
	ctx->srv = worker->srv;
	ctx->custom_commands = g_hash_table_new(rspamd_strcase_hash,
											rspamd_strcase_equal);
	ctx->plugins = g_hash_table_new_full(rspamd_ftok_icase_hash,
										 rspamd_ftok_icase_equal, rspamd_fstring_mapped_ftok_free,
										 rspamd_plugin_cbdata_dtor);

	ctx->task_timeout = rspamd_worker_check_and_adjust_timeout(ctx->cfg, ctx->task_timeout);

	if (ctx->max_auth_failures > 0) {
		if (!(ctx->auth_failure_window > 0)) {
			msg_warn_ctx("invalid auth_failure_window: %.1f, using the default %.1f "
						 "seconds instead",
						 ctx->auth_failure_window, (double) DEFAULT_AUTH_FAILURE_WINDOW);
			ctx->auth_failure_window = DEFAULT_AUTH_FAILURE_WINDOW;
		}

		ctx->auth_failures = rspamd_lru_hash_new_full(AUTH_FAILURES_CACHE_SIZE,
													  (GDestroyNotify) rspamd_inet_address_free,
													  g_free,
													  rspamd_inet_address_hash,
													  rspamd_inet_address_equal);
	}
	else {
		msg_info_ctx("authentication failure throttling is disabled");
	}

	if (ctx->max_connections_per_source > 0) {
		ctx->conns_per_source = g_hash_table_new_full(rspamd_inet_address_hash,
													  rspamd_inet_address_equal,
													  (GDestroyNotify) rspamd_inet_address_free,
													  g_free);
	}

	if (ctx->secure_ip != NULL) {
		rspamd_config_radix_from_ucl(ctx->cfg, ctx->secure_ip,
									 "Allow unauthenticated requests from these addresses",
									 &ctx->secure_map,
									 NULL,
									 worker, "controller secure ip");
	}

	ctx->lang_det = ctx->cfg->lang_det;

	rspamd_controller_password_sane(ctx, ctx->password, "normal password");
	rspamd_controller_password_sane(ctx, ctx->enable_password, "enable "
															   "password");

	/* Accept event */
	ctx->http_ctx = rspamd_http_context_create(ctx->cfg, ctx->event_loop,
											   ctx->cfg->ups_ctx);
	rspamd_mempool_add_destructor(ctx->cfg->cfg_pool,
								  (rspamd_mempool_destruct_t) rspamd_http_context_free,
								  ctx->http_ctx);
	ctx->http = rspamd_http_router_new(rspamd_controller_error_handler,
									   rspamd_controller_finish_handler, ctx->timeout,
									   ctx->static_files_dir, ctx->http_ctx);
	rspamd_http_router_set_max_size(ctx->http, ctx->cfg->max_message);

	if (rspamd_worker_has_ssl_socket(worker)) {
		if (ctx->ssl_cert && ctx->ssl_key) {
			gpointer server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);

			if (server_ssl_ctx) {
				rspamd_ssl_ctx_config(ctx->cfg, server_ssl_ctx);
				rspamd_http_router_set_ssl(ctx->http, server_ssl_ctx);
				msg_info_ctx("enabled SSL for controller worker");
			}
			else {
				msg_err_ctx("failed to create SSL context for controller worker");
			}
		}
		else {
			msg_err_ctx("ssl bind socket configured but ssl_cert or ssl_key is missing");
		}
	}

	/* Add callbacks for different methods */
	rspamd_http_router_add_path(ctx->http,
								PATH_AUTH,
								rspamd_controller_handle_auth);
	rspamd_http_router_add_path(ctx->http,
								PATH_SYMBOLS,
								rspamd_controller_handle_symbols);
	rspamd_http_router_add_path(ctx->http,
								PATH_ACTIONS,
								rspamd_controller_handle_actions);
	rspamd_http_router_add_path(ctx->http,
								PATH_MAPS,
								rspamd_controller_handle_maps);
	rspamd_http_router_add_path(ctx->http,
								PATH_GET_MAP,
								rspamd_controller_handle_get_map);
	rspamd_http_router_add_path(ctx->http,
								PATH_PIE_CHART,
								rspamd_controller_handle_pie_chart);
	rspamd_http_router_add_path(ctx->http,
								PATH_GRAPH,
								rspamd_controller_handle_graph);
	rspamd_http_router_add_path(ctx->http,
								PATH_HEALTHY,
								rspamd_controller_handle_healthy);
	rspamd_http_router_add_path(ctx->http,
								PATH_READY,
								rspamd_controller_handle_ready);
	rspamd_http_router_add_path(ctx->http,
								PATH_HISTORY,
								rspamd_controller_handle_history);
	rspamd_http_router_add_path(ctx->http,
								PATH_HISTORY_RESET,
								rspamd_controller_handle_history_reset);
	rspamd_http_router_add_path(ctx->http,
								PATH_LEARN_SPAM,
								rspamd_controller_handle_learnspam);
	rspamd_http_router_add_path(ctx->http,
								PATH_LEARN_HAM,
								rspamd_controller_handle_learnham);
	rspamd_http_router_add_path(ctx->http,
								PATH_LEARN_CLASS,
								rspamd_controller_handle_learnclass);
	rspamd_http_router_add_path(ctx->http,
								PATH_METRICS,
								rspamd_controller_handle_metrics);
	rspamd_http_router_add_path(ctx->http,
								PATH_SAVE_ACTIONS,
								rspamd_controller_handle_saveactions);
	rspamd_http_router_add_path(ctx->http,
								PATH_SAVE_SYMBOLS,
								rspamd_controller_handle_savesymbols);
	rspamd_http_router_add_path(ctx->http,
								PATH_SAVE_MAP,
								rspamd_controller_handle_savemap);
	rspamd_http_router_add_path(ctx->http,
								PATH_SCAN,
								rspamd_controller_handle_scan);
	rspamd_http_router_add_path(ctx->http,
								PATH_CHECK,
								rspamd_controller_handle_scan);
	rspamd_http_router_add_path(ctx->http,
								PATH_CHECKV2,
								rspamd_controller_handle_scan);
	rspamd_http_router_add_path(ctx->http,
								PATH_CHECKV3,
								rspamd_controller_handle_scan);
	rspamd_http_router_add_path(ctx->http,
								PATH_STAT,
								rspamd_controller_handle_stat);
	rspamd_http_router_add_path(ctx->http,
								PATH_STAT_RESET,
								rspamd_controller_handle_statreset);
	rspamd_http_router_add_path(ctx->http,
								PATH_COUNTERS,
								rspamd_controller_handle_counters);
	rspamd_http_router_add_path(ctx->http,
								PATH_ERRORS,
								rspamd_controller_handle_errors);
	rspamd_http_router_add_path(ctx->http,
								PATH_NEIGHBOURS,
								rspamd_controller_handle_neighbours);
	rspamd_http_router_add_path(ctx->http,
								PATH_PLUGINS,
								rspamd_controller_handle_plugins);
	rspamd_http_router_add_path(ctx->http,
								PATH_PING,
								rspamd_controller_handle_ping);
	rspamd_http_router_add_path(ctx->http,
								PATH_BAYES_CLASSIFIERS,
								rspamd_controller_handle_bayes_classifiers);
	rspamd_controller_register_plugins_paths(ctx);

#if 0
	rspamd_regexp_t *lua_re = rspamd_regexp_new ("^/.*/.*\\.lua$", NULL, NULL);
	rspamd_http_router_add_regexp (ctx->http, lua_re,
			rspamd_controller_handle_lua);
	rspamd_regexp_unref (lua_re);
#endif
	luaopen_controller(ctx->cfg->lua_state);

	if (ctx->key) {
		rspamd_http_router_set_key(ctx->http, ctx->key);
	}

	PTR_ARRAY_FOREACH(ctx->cfg->c_modules, i, mctx)
	{
		if (mctx->mod->module_attach_controller_func != NULL) {
			mctx->mod->module_attach_controller_func(mctx,
													 ctx->custom_commands);
		}
	}

	g_hash_table_iter_init(&iter, ctx->custom_commands);
	while (g_hash_table_iter_next(&iter, &key, &value)) {
		rspamd_http_router_add_path(ctx->http,
									key,
									rspamd_controller_handle_custom);
	}

	if (worker->srv->cfg->neighbours && worker->srv->cfg->neighbours->len > 0) {
		rspamd_http_router_add_header(ctx->http,
									  "Access-Control-Allow-Origin", "*");
	}

	/* Disable all results caching, see #3330 */
	rspamd_http_router_add_header(ctx->http,
								  "Cache-Control", "no-store");

	rspamd_http_router_set_unknown_handler(ctx->http,
										   rspamd_controller_handle_unknown);

	ctx->resolver = rspamd_dns_resolver_init(worker->srv->logger,
											 ctx->event_loop,
											 worker->srv->cfg);

	rspamd_upstreams_library_config(worker->srv->cfg, worker->srv->cfg->ups_ctx,
									ctx->event_loop, ctx->resolver->r);
	rspamd_symcache_start_refresh(worker->srv->cfg->cache, ctx->event_loop,
								  worker);
	rspamd_stat_init(worker->srv->cfg, ctx->event_loop);
	rspamd_worker_init_controller(worker, &ctx->rrd);
	rspamd_lua_run_postloads(ctx->cfg->lua_state, ctx->cfg, ctx->event_loop, worker);

	/* TODO: maybe make it configurable */
	ev_timer_init(&ctx->health_check_timer, rspamd_controller_health_timer,
				  1.0, 60.0);
	ctx->health_check_timer.data = ctx;
	ev_timer_start(ctx->event_loop, &ctx->health_check_timer);

#ifdef WITH_HYPERSCAN
	rspamd_control_worker_add_cmd_handler(worker,
										  RSPAMD_CONTROL_HYPERSCAN_LOADED,
										  rspamd_worker_hyperscan_ready,
										  NULL);
#endif

	/* Start event loop */
	ev_loop(ctx->event_loop, 0);
	rspamd_worker_block_signals();
	rspamd_controller_on_terminate(worker, ctx->rrd);

	rspamd_stat_close();
	rspamd_http_router_free(ctx->http);

	if (ctx->cached_password.len > 0) {
		m = (gpointer) ctx->cached_password.begin;
		munmap(m, ctx->cached_password.len);
	}

	if (ctx->cached_enable_password.len > 0) {
		m = (gpointer) ctx->cached_enable_password.begin;
		munmap(m, ctx->cached_enable_password.len);
	}

	if (ctx->auth_failures != NULL) {
		rspamd_lru_hash_destroy(ctx->auth_failures);
	}

	g_hash_table_unref(ctx->plugins);
	g_hash_table_unref(ctx->custom_commands);

	CFG_REF_RELEASE(ctx->cfg);
	CFG_REF_RELEASE(ctx->cfg);
	rspamd_log_close(worker->srv->logger);
	rspamd_unset_crash_handler(worker->srv);

	exit(EXIT_SUCCESS);
}
