// Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <base/command_line.h>
#include <base/files/file_util.h>
#include <base/files/scoped_temp_dir.h>
#include <base/logging.h>
#include <base/strings/string_number_conversions.h>
#include <base/strings/stringprintf.h>
#include <brillo/process/process_mock.h>
#include <brillo/syslog_logging.h>
#include <brillo/test_helpers.h>
#include <gtest/gtest.h>

#include "vpn-manager/daemon_mock.h"
#include "vpn-manager/ipsec_manager.h"

using ::base::FilePath;
using ::brillo::FindLog;
using ::brillo::ProcessMock;
using ::testing::_;
using ::testing::InSequence;
using ::testing::Return;

namespace vpn_manager {

namespace {

const int kMockFd = 123;

const int kMockStarterPid = 10001;

}  // namespace

class IpsecManagerTest : public ::testing::Test {
 public:
  IpsecManagerTest() : starter_daemon_(nullptr), charon_daemon_(nullptr) {}
  ~IpsecManagerTest() override = default;

  static FilePath GetSourceDirectory() {
    FilePath src_dir;
    const char* src_env = getenv("SRC");
    if (src_env) {
      src_dir = FilePath(src_env);
    }
    return src_dir;
  }

  void SetUp() override {
    CHECK(temp_dir_.CreateUniqueTempDir());
    test_path_ = temp_dir_.GetPath().Append("ipsec_manager_testdir");
    base::DeleteFile(test_path_, true);
    base::CreateDirectory(test_path_);
    persistent_path_ = test_path_.Append("persistent");
    base::CreateDirectory(persistent_path_);
    remote_address_text_ = "1.2.3.4";
    ASSERT_TRUE(ServiceManager::ConvertIPStringToSockAddr(remote_address_text_,
                                                          &remote_address_));
    psk_file_ = test_path_.Append("psk").value();
    xauth_credentials_file_ = test_path_.Append("xauth_credentials").value();
    server_ca_file_ = test_path_.Append("server.ca").value();
    WriteFile(server_ca_file_, "contents not used for testing");
    server_id_ = "CN=vpnserver";
    client_cert_tpm_slot_ = "0";
    client_cert_tpm_id_ = "0a";
    tpm_user_pin_ = "123456";
    ipsec_run_path_ = test_path_.Append("run").value();
    // Ipsec runtime data dir is created in shill init script, so just create
    // it here as well for the purposes of this test.
    base::CreateDirectory(FilePath(ipsec_run_path_));
    ipsec_up_file_ = FilePath(ipsec_run_path_).Append("up").value();
    WriteFile(psk_file_, "secret");
    WriteFile(
        xauth_credentials_file_,
        base::StringPrintf("%s\n%s\n", kXauthUser, kXauthPassword).c_str());
    base::CopyFile(GetSourceDirectory().Append("testdata/cacert.der"),
                   FilePath(server_ca_file_));
    brillo::ClearLog();
    starter_daemon_ = new DaemonMock;
    charon_daemon_ = new DaemonMock;
    ipsec_.reset(
        new IpsecManager("aes128-sha1,3des-sha1,aes128-md5,3des-md5",  // esp
                         "3des-sha1-modp1024",                         // ike
                         30,                         // ipsec_timeout
                         "17/1701",                  // left_protoport
                         true,                       // rekey
                         "17/1701",                  // right_protoport
                         "",                         // tunnel_group
                         "transport",                // type
                         test_path_,                 // temp_path
                         persistent_path_));         // persistent_path
    ipsec_->starter_daemon_.reset(starter_daemon_);  // Passes ownership.
    ipsec_->charon_daemon_.reset(charon_daemon_);    // Passes ownership.
    ipsec_->ipsec_group_ = getgid();
    ipsec_->ipsec_up_file_ = ipsec_up_file_;
    ipsec_->force_local_address_ = "5.6.7.8";
  }

  // Creates a ProcessMock that will be handed to to the IpsecManager when
  // it creates a process.  The caller owns this mock and is responsible for
  // disposing of it (since the IpsecManager assumes the Daemon owns it).
  ProcessMock* SetStartStarterExpectations();

 protected:
  static const char kXauthUser[];
  static const char kXauthPassword[];

  void WriteFile(const std::string& file_path, const char* contents) {
    if (base::WriteFile(FilePath(file_path), contents, strlen(contents)) < 0) {
      LOG(ERROR) << "Unable to create " << file_path;
    }
  }

  void DoInitialize(int ike_version, bool use_psk, bool use_xauth);

  std::unique_ptr<IpsecManager> ipsec_;
  FilePath persistent_path_;
  FilePath test_path_;
  std::string remote_address_text_;
  sockaddr_storage remote_address_;
  std::string psk_file_;
  std::string server_ca_file_;
  std::string xauth_credentials_file_;
  std::string server_id_;
  std::string client_cert_tpm_slot_;
  std::string client_cert_tpm_id_;
  std::string tpm_user_pin_;
  std::string ipsec_run_path_;
  std::string ipsec_up_file_;
  // These mock daemons are owned by the ipsec instance and tracked here only
  // for expectations.
  DaemonMock* starter_daemon_;
  DaemonMock* charon_daemon_;
  base::ScopedTempDir temp_dir_;
};

// static
const char IpsecManagerTest::kXauthUser[] = "xauth_user";
const char IpsecManagerTest::kXauthPassword[] = "xauth_password";

void IpsecManagerTest::DoInitialize(int ike_version,
                                    bool use_psk,
                                    bool use_xauth) {
  std::string xauth_file;
  if (use_xauth) {
    xauth_file = xauth_credentials_file_;
  }
  if (use_psk) {
    ASSERT_TRUE(ipsec_->Initialize(ike_version, remote_address_, psk_file_,
                                   xauth_file, "", "", "", "", ""));
  } else {
    ASSERT_TRUE(ipsec_->Initialize(
        ike_version, remote_address_, "", xauth_file, server_ca_file_,
        server_id_, client_cert_tpm_slot_, client_cert_tpm_id_, tpm_user_pin_));
  }
}

ProcessMock* IpsecManagerTest::SetStartStarterExpectations() {
  EXPECT_CALL(*starter_daemon_, FindProcess());
  EXPECT_CALL(*charon_daemon_, FindProcess());
  EXPECT_CALL(*starter_daemon_, ClearProcess());
  EXPECT_CALL(*charon_daemon_, ClearProcess());
  ProcessMock* process = new ProcessMock;
  // Does not pass ownership.
  EXPECT_CALL(*starter_daemon_, CreateProcessWithResourceLimits(_))
      .WillOnce(Return(process));
  EXPECT_CALL(*process, AddArg(IPSEC_STARTER));
  EXPECT_CALL(*process, AddArg("--nofork"));
  EXPECT_CALL(*process, RedirectUsingPipe(STDERR_FILENO, false));
  EXPECT_CALL(*process, Start()).WillOnce(Return(true));
  EXPECT_CALL(*process, GetPipe(STDERR_FILENO)).WillOnce(Return(kMockFd));
  EXPECT_CALL(*process, pid()).WillOnce(Return(kMockStarterPid));
  return process;
}

TEST_F(IpsecManagerTest, InitializeNoAuth) {
  EXPECT_FALSE(
      ipsec_->Initialize(1, remote_address_, "", "", "", "", "", "", ""));
  EXPECT_TRUE(FindLog("Must specify either PSK or certificates"));
}

TEST_F(IpsecManagerTest, InitializeNotBoth) {
  EXPECT_TRUE(ipsec_->Initialize(
      1, remote_address_, psk_file_, "", server_ca_file_, server_id_,
      client_cert_tpm_slot_, client_cert_tpm_id_, tpm_user_pin_));
  EXPECT_TRUE(FindLog("Specified both certificates and PSK to IPsec layer"));
}

TEST_F(IpsecManagerTest, InitializeUnsupportedVersion) {
  EXPECT_FALSE(ipsec_->Initialize(3, remote_address_, psk_file_, "", "", "", "",
                                  "", ""));
  EXPECT_TRUE(FindLog("Unsupported IKE version"));
}

TEST_F(IpsecManagerTest, InitializeIkev2WithCertificates) {
  EXPECT_FALSE(ipsec_->Initialize(2, remote_address_, "", "", server_ca_file_,
                                  server_id_, client_cert_tpm_slot_,
                                  client_cert_tpm_id_, tpm_user_pin_));
  EXPECT_TRUE(FindLog("Only IKE version 1 is supported with certificates"));
}

TEST_F(IpsecManagerTest, PollWaitIfNotUpYet) {
  ipsec_->start_ticks_ = base::TimeTicks::Now();
  EXPECT_EQ(1000, ipsec_->Poll());
}

TEST_F(IpsecManagerTest, PollTimeoutWaiting) {
  int ipsec_timeout = 30;
  if (base::CommandLine::InitializedForCurrentProcess()) {
    base::CommandLine* cl = base::CommandLine::ForCurrentProcess();
    if (cl->HasSwitch("ipsec_timeout")) {
      int conversion = 0;
      if (base::StringToInt(cl->GetSwitchValueASCII("ipsec_timeout"),
                            &conversion))
        ipsec_timeout = conversion;
    }
  }

  ipsec_->start_ticks_ =
      base::TimeTicks::Now() - base::TimeDelta::FromSeconds(ipsec_timeout + 1);
  EXPECT_EQ(1000, ipsec_->Poll());
  EXPECT_TRUE(FindLog("IPsec connection timed out"));
  EXPECT_TRUE(ipsec_->was_stopped());
}

TEST_F(IpsecManagerTest, PollTransitionToUp) {
  ipsec_->start_ticks_ = base::TimeTicks::Now();
  EXPECT_TRUE(base::PathExists(FilePath(ipsec_run_path_)));
  WriteFile(ipsec_up_file_, "");
  EXPECT_FALSE(ipsec_->is_running());
  EXPECT_EQ(-1, ipsec_->Poll());
  EXPECT_TRUE(FindLog("IPsec connection now up"));
  EXPECT_TRUE(ipsec_->is_running());
}

TEST_F(IpsecManagerTest, PollNothingIfRunning) {
  ipsec_->is_running_ = true;
  EXPECT_EQ(-1, ipsec_->Poll());
}

TEST_F(IpsecManagerTest, FormatSecretsNoSlot) {
  client_cert_tpm_slot_ = "";
  DoInitialize(1, false, false);
  std::string formatted;
  EXPECT_TRUE(ipsec_->FormatSecrets(&formatted));
  EXPECT_EQ("5.6.7.8 1.2.3.4 : PIN %smartcard0@crypto_module:0a \"123456\"\n",
            formatted);
}

TEST_F(IpsecManagerTest, FormatSecretsNonZeroSlot) {
  client_cert_tpm_slot_ = "1";
  DoInitialize(1, false, false);
  std::string formatted;
  EXPECT_TRUE(ipsec_->FormatSecrets(&formatted));
  EXPECT_EQ("5.6.7.8 1.2.3.4 : PIN %smartcard1@crypto_module:0a \"123456\"\n",
            formatted);
}

TEST_F(IpsecManagerTest, FormatSecretsXauthCredentials) {
  client_cert_tpm_slot_ = "1";
  DoInitialize(1, false, true);
  std::string formatted;
  EXPECT_TRUE(ipsec_->FormatSecrets(&formatted));
  EXPECT_EQ(
      base::StringPrintf(
          "5.6.7.8 1.2.3.4 : PIN %%smartcard1@crypto_module:0a \"123456\"\n"
          "%s : XAUTH \"%s\"\n",
          kXauthUser, kXauthPassword),
      formatted);
  EXPECT_EQ(kXauthUser, ipsec_->xauth_identity_);
}

TEST_F(IpsecManagerTest, FormatStrongswanConfigFile) {
  std::string strongswan_config(
      "libstrongswan {\n"
      "  plugins {\n"
      "    pkcs11 {\n"
      "      modules {\n"
      "        crypto_module {\n"
      "          path = " PKCS11_LIB
      "\n"
      "        }\n"
      "      }\n"
      "    }\n"
      "  }\n"
      "}\n"
      "charon {\n"
      "  accept_unencrypted_mainmode_messages = yes\n"
      "  ignore_routing_tables = 0\n"
      "  install_routes = no\n"
      "  routing_table = 0\n"
      "}\n");
  EXPECT_EQ(strongswan_config, ipsec_->FormatStrongswanConfigFile());
}

TEST_F(IpsecManagerTest, StartStarter) {
  InSequence unused;
  std::unique_ptr<ProcessMock> process(SetStartStarterExpectations());
  EXPECT_TRUE(ipsec_->StartStarter());
  EXPECT_EQ(kMockFd, ipsec_->output_fd());
  EXPECT_EQ("ipsec[10001]: ", ipsec_->ipsec_prefix_);
}

TEST_F(IpsecManagerTest, StopWhileRunning) {
  InSequence unused;
  EXPECT_CALL(*starter_daemon_, IsRunning()).WillOnce(Return(true));
  EXPECT_CALL(*starter_daemon_, FindProcess()).Times(0);
  EXPECT_CALL(*charon_daemon_, FindProcess()).Times(1);
  EXPECT_CALL(*starter_daemon_, Terminate()).WillOnce(Return(true));
  EXPECT_CALL(*charon_daemon_, Terminate()).WillOnce(Return(false));
  ipsec_->Stop();
}

TEST_F(IpsecManagerTest, StopWhileNotRunning) {
  InSequence unused;
  EXPECT_CALL(*starter_daemon_, IsRunning()).WillOnce(Return(false));
  EXPECT_CALL(*starter_daemon_, FindProcess()).Times(1);
  EXPECT_CALL(*charon_daemon_, FindProcess()).Times(1);
  EXPECT_CALL(*starter_daemon_, Terminate()).WillOnce(Return(false));
  EXPECT_CALL(*charon_daemon_, Terminate()).WillOnce(Return(false));
  ipsec_->Stop();
}

class IpsecManagerTestIkeV1Psk : public IpsecManagerTest {
 public:
  void SetUp() override {
    IpsecManagerTest::SetUp();
    DoInitialize(1, true, false);
  }

 protected:
  std::string GetExpectedStarter(bool debug, bool xauth);
};

TEST_F(IpsecManagerTestIkeV1Psk, Initialize) {}

TEST_F(IpsecManagerTestIkeV1Psk, FormatSecrets) {
  FilePath input(psk_file_);
  const char psk[] = "pAssword\n";
  base::WriteFile(input, psk, strlen(psk));
  std::string formatted;
  EXPECT_TRUE(ipsec_->FormatSecrets(&formatted));
  EXPECT_EQ("5.6.7.8 1.2.3.4 : PSK \"pAssword\"\n", formatted);
}

std::string IpsecManagerTestIkeV1Psk::GetExpectedStarter(bool debug,
                                                         bool xauth) {
  std::string expected("config setup\n");
  if (debug) {
    expected.append("\tcharondebug=\"ike 4, cfg 2, knl 4, net 3, enc 1\"\n");
  } else {
    expected.append("\tcharondebug=\"ike 2, cfg 2, knl 2, net 1, enc 1\"\n");
  }

  expected.append("\tuniqueids=\"no\"\n");
  expected.append(
      "conn managed\n"
      "\tike=\"3des-sha1-modp1024\"\n"
      "\tesp=\"aes128-sha1,3des-sha1,aes128-md5,3des-md5\"\n"
      "\tkeyexchange=\"ikev1\"\n");

  if (xauth) {
    expected.append(
        base::StringPrintf("\tauthby=\"xauthpsk\"\n"
                           "\txauth=\"client\"\n"
                           "\txauth_identity=\"%s\"\n",
                           kXauthUser));
  } else {
    expected.append("\tauthby=\"psk\"\n");
  }

  expected.append(
      "\trekey=yes\n"
      "\tleft=\"%defaultroute\"\n"
      "\tleftprotoport=\"17/1701\"\n"
      "\tleftupdown=\"/usr/libexec/l2tpipsec_vpn/pluto_updown\"\n"
      "\tright=\"1.2.3.4\"\n"
      "\trightid=\"%any\"\n"
      "\trightprotoport=\"17/1701\"\n"
      "\ttype=\"transport\"\n"
      "\tauto=\"start\"\n");
  return expected;
}

TEST_F(IpsecManagerTestIkeV1Psk, FormatStarterConfigFile) {
  EXPECT_EQ(GetExpectedStarter(false, false),
            ipsec_->FormatStarterConfigFile());
  logging::SetMinLogLevel(-5);
  EXPECT_EQ(GetExpectedStarter(true, false), ipsec_->FormatStarterConfigFile());
  ipsec_->xauth_identity_ = kXauthUser;
  EXPECT_EQ(GetExpectedStarter(true, true), ipsec_->FormatStarterConfigFile());
  logging::SetMinLogLevel(0);
  EXPECT_EQ(GetExpectedStarter(false, true), ipsec_->FormatStarterConfigFile());
}

TEST_F(IpsecManagerTestIkeV1Psk, Start) {
  InSequence unused;
  std::unique_ptr<ProcessMock> process(SetStartStarterExpectations());
  EXPECT_TRUE(ipsec_->Start());
  EXPECT_FALSE(ipsec_->start_ticks_.is_null());
}

TEST_F(IpsecManagerTestIkeV1Psk, WriteConfigFiles) {
  logging::SetMinLogLevel(0);
  EXPECT_TRUE(ipsec_->WriteConfigFiles());
  std::string conf_contents;
  ASSERT_TRUE(base::ReadFileToString(persistent_path_.Append("ipsec.conf"),
                                     &conf_contents));
  EXPECT_EQ(GetExpectedStarter(false, false), conf_contents);
  ASSERT_TRUE(base::PathExists(persistent_path_.Append("ipsec.secrets")));
}

class IpsecManagerTestIkeV1Certs : public IpsecManagerTest {
 public:
  void SetUp() override {
    IpsecManagerTest::SetUp();
    DoInitialize(1, false, false);
  }

 protected:
  std::string GetExpectedStarter(bool debug);
};

TEST_F(IpsecManagerTestIkeV1Certs, Initialize) {
  DoInitialize(1, false, false);
}

TEST_F(IpsecManagerTestIkeV1Certs, FormatSecrets) {
  std::string formatted;
  EXPECT_TRUE(ipsec_->FormatSecrets(&formatted));
  EXPECT_EQ("5.6.7.8 1.2.3.4 : PIN %smartcard0@crypto_module:0a \"123456\"\n",
            formatted);
}

std::string IpsecManagerTestIkeV1Certs::GetExpectedStarter(bool debug) {
  std::string expected("config setup\n");
  if (debug) {
    expected.append("\tcharondebug=\"ike 4, cfg 2, knl 4, net 3, enc 1\"\n");
  } else {
    expected.append("\tcharondebug=\"ike 2, cfg 2, knl 2, net 1, enc 1\"\n");
  }

  expected.append("\tuniqueids=\"no\"\n");
  expected.append(
      "conn managed\n"
      "\tike=\"3des-sha1-modp1024\"\n"
      "\tesp=\"aes128-sha1,3des-sha1,aes128-md5,3des-md5\"\n"
      "\tkeyexchange=\"ikev1\"\n"
      "\trekey=yes\n"
      "\tleft=\"%defaultroute\"\n"
      "\tleftcert=\"%smartcard0@crypto_module:0a\"\n"
      "\tleftprotoport=\"17/1701\"\n"
      "\tleftupdown=\"/usr/libexec/l2tpipsec_vpn/pluto_updown\"\n"
      "\tright=\"1.2.3.4\"\n"
      "\trightca=\"C=US, O=simonjam, CN=rootca\"\n"
      "\trightid=\"CN=vpnserver\"\n"
      "\trightprotoport=\"17/1701\"\n"
      "\ttype=\"transport\"\n"
      "\tauto=\"start\"\n");
  return expected;
}

TEST_F(IpsecManagerTestIkeV1Certs, FormatStarterConfigFile) {
  logging::SetMinLogLevel(0);
  EXPECT_EQ(GetExpectedStarter(false), ipsec_->FormatStarterConfigFile());
  logging::SetMinLogLevel(-5);
  EXPECT_EQ(GetExpectedStarter(true), ipsec_->FormatStarterConfigFile());

  // The xauth parameters aren't pertinent to certificate-based authentication.
  ipsec_->xauth_identity_ = kXauthUser;
  EXPECT_EQ(GetExpectedStarter(true), ipsec_->FormatStarterConfigFile());
}

TEST_F(IpsecManagerTestIkeV1Certs, WriteConfigFiles) {
  logging::SetMinLogLevel(0);
  EXPECT_TRUE(ipsec_->WriteConfigFiles());
  std::string conf_contents;
  ASSERT_TRUE(base::ReadFileToString(persistent_path_.Append("ipsec.conf"),
                                     &conf_contents));
  EXPECT_EQ(GetExpectedStarter(false), conf_contents);
  ASSERT_TRUE(base::PathExists(persistent_path_.Append("ipsec.secrets")));
  ASSERT_TRUE(base::PathExists(persistent_path_.Append("cacert.der")));
}

class IpsecManagerTestBogusCerts : public IpsecManagerTest {
 public:
  void SetUp() override {
    IpsecManagerTest::SetUp();
    // testdata/bogus_cacert.der is generated as follows:
    //
    //   openssl genrsa -des3 -out ca.key 512
    //   openssl req -new -x509 -days 365 -key ca.key -out bogus_cacert.pem \
    //       -subj "/CN=$(printf 'a \r b \n c \t d \f e \b f " g \\\\')"
    //   openssl x509 -in bogus_cacert.pem -out bogus_cacert.der -outform DER
    //
    //  The subject field contains a CN attribute with special characters that
    //  require escaping.
    FilePath bogus_server_ca_file = test_path_.Append("bogus_server.ca");
    base::CopyFile(GetSourceDirectory().Append("testdata/bogus_cacert.der"),
                   bogus_server_ca_file);
    ASSERT_TRUE(ipsec_->Initialize(
        1, remote_address_, "", "", bogus_server_ca_file.value(), server_id_,
        client_cert_tpm_slot_, client_cert_tpm_id_, tpm_user_pin_));
  }
};

TEST_F(IpsecManagerTestBogusCerts, FormatStarterConfigFile) {
  std::string expected =
      "config setup\n"
      "\tcharondebug=\"ike 2, cfg 2, knl 2, net 1, enc 1\"\n"
      "\tuniqueids=\"no\"\n"
      "conn managed\n"
      "\tike=\"3des-sha1-modp1024\"\n"
      "\tesp=\"aes128-sha1,3des-sha1,aes128-md5,3des-md5\"\n"
      "\tkeyexchange=\"ikev1\"\n"
      "\trekey=yes\n"
      "\tleft=\"%defaultroute\"\n"
      "\tleftcert=\"%smartcard0@crypto_module:0a\"\n"
      "\tleftprotoport=\"17/1701\"\n"
      "\tleftupdown=\"/usr/libexec/l2tpipsec_vpn/pluto_updown\"\n"
      "\tright=\"1.2.3.4\"\n"
      // The value of the rightca option should contain an escaped version of
      // the subject field in the testdata/bogus_cacert.der file.
      "\trightca=\"CN=a \\r b \\n c \\t d \\f e \\b f \\\" g \\\\\"\n"
      "\trightid=\"CN=vpnserver\"\n"
      "\trightprotoport=\"17/1701\"\n"
      "\ttype=\"transport\"\n"
      "\tauto=\"start\"\n";
  logging::SetMinLogLevel(0);
  EXPECT_EQ(expected, ipsec_->FormatStarterConfigFile());
}

}  // namespace vpn_manager