// Copyright 2021 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <cryptohome/storage/cryptohome_vault.h>

#include <memory>
#include <utility>

#include <brillo/secure_blob.h>
#include <gmock/gmock.h>
#include <gtest/gtest.h>

#include "cryptohome/filesystem_layout.h"
#include "cryptohome/mock_platform.h"
#include "cryptohome/storage/encrypted_container/backing_device.h"
#include "cryptohome/storage/encrypted_container/backing_device_factory.h"
#include "cryptohome/storage/encrypted_container/encrypted_container.h"
#include "cryptohome/storage/encrypted_container/fake_backing_device.h"
#include "cryptohome/storage/encrypted_container/fake_encrypted_container_factory.h"
#include "cryptohome/storage/encrypted_container/filesystem_key.h"
#include "cryptohome/storage/mock_homedirs.h"

using ::testing::_;
using ::testing::DoAll;
using ::testing::Return;
using ::testing::SetArgPointee;

namespace cryptohome {

namespace {
struct CryptohomeVaultTestParams {
  CryptohomeVaultTestParams(EncryptedContainerType type,
                            EncryptedContainerType migrating_type,
                            EncryptedContainerType cache_type)
      : container_type(type),
        migrating_container_type(migrating_type),
        cache_container_type(cache_type) {}

  EncryptedContainerType container_type;
  EncryptedContainerType migrating_container_type;
  EncryptedContainerType cache_container_type;
};
}  // namespace

class CryptohomeVaultTest
    : public ::testing::TestWithParam<CryptohomeVaultTestParams> {
 public:
  CryptohomeVaultTest()
      : obfuscated_username_("foo"),
        key_reference_({.fek_sig = brillo::SecureBlob("random keyref")}),
        key_({.fek = brillo::SecureBlob("random key")}),
        backing_dir_(ShadowRoot().Append(obfuscated_username_)),
        encrypted_container_factory_(&platform_) {}
  ~CryptohomeVaultTest() override = default;

  EncryptedContainerType ContainerType() { return GetParam().container_type; }

  EncryptedContainerType MigratingContainerType() {
    return GetParam().migrating_container_type;
  }

  EncryptedContainerType CacheContainerType() {
    return GetParam().cache_container_type;
  }

  EncryptedContainerConfig ConfigFromType(EncryptedContainerType type,
                                          const std::string& name) {
    EncryptedContainerConfig config;
    config.type = type;
    switch (type) {
      case EncryptedContainerType::kEcryptfs:
        config.backing_dir = backing_dir_.Append(kEcryptfsVaultDir);
        break;
      case EncryptedContainerType::kFscrypt:
        config.backing_dir = backing_dir_.Append(kMountDir);
        break;
      case EncryptedContainerType::kDmcrypt:
        config = {
            .type = EncryptedContainerType::kDmcrypt,
            .dmcrypt_config = {
                .backing_device_config =
                    {.type = BackingDeviceType::kLogicalVolumeBackingDevice,
                     .name = name,
                     .size = 100 * 1024 * 1024,
                     .logical_volume = {.thinpool_name = "thinpool",
                                        .physical_volume =
                                            base::FilePath("/dev/sda1")}},
                .dmcrypt_device_name = "dmcrypt-" + name,
                .dmcrypt_cipher = "aes-xts-plain64",
                .mkfs_opts = {"-O", "^huge_file,^flex_bg,", "-E",
                              "discard,lazy_itable_init"},
                .tune2fs_opts = {"-O", "verity,quota", "-Q",
                                 "usrquota,grpquota"}}};
        break;
      default:
        config.type = EncryptedContainerType::kUnknown;
        break;
    }

    return config;
  }

  void ExpectEcryptfsSetup() {
    EXPECT_CALL(platform_, AddEcryptfsAuthToken(_, _, _))
        .Times(2)
        .WillRepeatedly(Return(true));
  }

  void ExpectFscryptSetup() {
    EXPECT_CALL(platform_, AddDirCryptoKeyToKeyring(_, _))
        .WillOnce(Return(true));
    EXPECT_CALL(platform_, SetDirCryptoKey(backing_dir_.Append(kMountDir), _))
        .WillOnce(Return(true));
  }

  void ExpectDmcryptSetup(const std::string& name) {
    base::FilePath backing_device_path = base::FilePath("/dev").Append(name);
    base::FilePath dmcrypt_device("/dev/mapper/dmcrypt-" + name);
    EXPECT_CALL(platform_, GetBlkSize(backing_device_path, _))
        .WillOnce(DoAll(SetArgPointee<1>(1024 * 1024 * 1024), Return(true)));
    EXPECT_CALL(platform_, UdevAdmSettle(dmcrypt_device, _))
        .WillOnce(Return(true));
    EXPECT_CALL(platform_, FormatExt4(_, _, _)).WillRepeatedly(Return(true));
    EXPECT_CALL(platform_, Tune2Fs(dmcrypt_device, _)).WillOnce(Return(true));
  }

  void ExpectEcryptfsTeardown() {
    EXPECT_CALL(platform_, ClearUserKeyring()).WillRepeatedly(Return(true));
  }

  void ExpectFscryptTeardown() {
    EXPECT_CALL(platform_,
                InvalidateDirCryptoKey(_, backing_dir_.Append(kMountDir)))
        .WillRepeatedly(Return(true));
  }

  void ExpectContainerSetup(EncryptedContainerType type) {
    switch (type) {
      case EncryptedContainerType::kEcryptfs:
        ExpectEcryptfsSetup();
        break;
      case EncryptedContainerType::kFscrypt:
        ExpectFscryptSetup();
        break;
      case EncryptedContainerType::kDmcrypt:
        ExpectDmcryptSetup("data");
        break;
      default:
        break;
    }
  }

  void ExpectCacheContainerSetup(EncryptedContainerType type) {
    switch (type) {
      case EncryptedContainerType::kDmcrypt:
        ExpectDmcryptSetup("cache");
        break;
      default:
        break;
    }
  }

  void ExpectContainerTeardown(EncryptedContainerType type) {
    switch (type) {
      case EncryptedContainerType::kEcryptfs:
        ExpectEcryptfsTeardown();
        break;
      case EncryptedContainerType::kFscrypt:
        ExpectFscryptTeardown();
        break;
      default:
        break;
    }
  }

  void CreateExistingContainer(EncryptedContainerType type) {
    switch (type) {
      case EncryptedContainerType::kEcryptfs:
        platform_.CreateDirectory(backing_dir_.Append(kEcryptfsVaultDir));
        break;
      case EncryptedContainerType::kFscrypt:
        platform_.CreateDirectory(backing_dir_.Append(kMountDir));
        break;
      default:
        break;
    }
  }

  void CheckContainersExist() {
    // For newly created fscrypt containers, add the expectation that fetching
    // the key state returns encrypted.
    if (vault_->container_->GetType() == EncryptedContainerType::kFscrypt ||
        (vault_->migrating_container_ &&
         vault_->migrating_container_->GetType() ==
             EncryptedContainerType::kFscrypt)) {
      EXPECT_CALL(platform_,
                  GetDirCryptoKeyState(backing_dir_.Append(kMountDir)))
          .WillOnce(Return(dircrypto::KeyState::ENCRYPTED));
    }
    EXPECT_TRUE(vault_->container_->Exists());
    if (vault_->migrating_container_) {
      EXPECT_TRUE(vault_->migrating_container_->Exists());
    }
    if (vault_->cache_container_) {
      EXPECT_TRUE(vault_->cache_container_->Exists());
    }
  }

  void ExpectVaultSetup() {
    EXPECT_CALL(platform_, ClearUserKeyring()).WillOnce(Return(true));
    EXPECT_CALL(platform_, SetupProcessKeyring()).WillOnce(Return(true));
  }

  void ExpectVaultTeardownOnDestruction() {
    ExpectContainerTeardown(ContainerType());
    ExpectContainerTeardown(MigratingContainerType());
    ExpectContainerTeardown(CacheContainerType());
  }

  void GenerateVault(bool create_container,
                     bool create_migrating_container,
                     bool create_cache_container) {
    std::unique_ptr<EncryptedContainer> container =
        encrypted_container_factory_.Generate(
            ConfigFromType(ContainerType(), "data"), key_reference_,
            create_container);
    if (create_container)
      CreateExistingContainer(ContainerType());

    std::unique_ptr<EncryptedContainer> migrating_container =
        encrypted_container_factory_.Generate(
            ConfigFromType(MigratingContainerType(), "data"), key_reference_,
            create_migrating_container);
    if (create_migrating_container)
      CreateExistingContainer(MigratingContainerType());

    std::unique_ptr<EncryptedContainer> cache_container =
        encrypted_container_factory_.Generate(
            ConfigFromType(CacheContainerType(), "cache"), key_reference_,
            create_cache_container);
    if (create_cache_container)
      CreateExistingContainer(CacheContainerType());

    vault_ = std::make_unique<CryptohomeVault>(
        obfuscated_username_, std::move(container),
        std::move(migrating_container), std::move(cache_container), &platform_);
  }

 protected:
  const std::string obfuscated_username_;
  const FileSystemKeyReference key_reference_;
  const FileSystemKey key_;
  const base::FilePath backing_dir_;

  MockHomeDirs homedirs_;
  MockPlatform platform_;
  FakeEncryptedContainerFactory encrypted_container_factory_;
  std::unique_ptr<CryptohomeVault> vault_;
};

INSTANTIATE_TEST_SUITE_P(WithEcryptfs,
                         CryptohomeVaultTest,
                         ::testing::Values(CryptohomeVaultTestParams(
                             EncryptedContainerType::kEcryptfs,
                             EncryptedContainerType::kUnknown,
                             EncryptedContainerType::kUnknown)));
INSTANTIATE_TEST_SUITE_P(WithFscrypt,
                         CryptohomeVaultTest,
                         ::testing::Values(CryptohomeVaultTestParams(
                             EncryptedContainerType::kFscrypt,
                             EncryptedContainerType::kUnknown,
                             EncryptedContainerType::kUnknown)));
INSTANTIATE_TEST_SUITE_P(WithFscryptMigration,
                         CryptohomeVaultTest,
                         ::testing::Values(CryptohomeVaultTestParams(
                             EncryptedContainerType::kEcryptfs,
                             EncryptedContainerType::kFscrypt,
                             EncryptedContainerType::kUnknown)));

INSTANTIATE_TEST_SUITE_P(WithDmcrypt,
                         CryptohomeVaultTest,
                         ::testing::Values(CryptohomeVaultTestParams(
                             EncryptedContainerType::kDmcrypt,
                             EncryptedContainerType::kUnknown,
                             EncryptedContainerType::kDmcrypt)));

// Tests failure path on failure to setup process keyring for eCryptfs and
// fscrypt.
TEST_P(CryptohomeVaultTest, FailedProcessKeyringSetup) {
  GenerateVault(/*create_container=*/false,
                /*create_migrating_container=*/false,
                /*create_cache_container=*/false);
  EXPECT_CALL(platform_, SetupProcessKeyring()).WillOnce(Return(false));
  EXPECT_EQ(vault_->Setup(key_, /*create=*/true),
            MOUNT_ERROR_SETUP_PROCESS_KEYRING_FAILED);
  ExpectVaultTeardownOnDestruction();
}

// Tests the failure path on Setup if setting up the container fails.
TEST_P(CryptohomeVaultTest, ContainerSetupFailed) {
  GenerateVault(/*create_container=*/false,
                /*create_migrating_container=*/false,
                /*create_cache_container=*/false);
  ExpectVaultSetup();
  EXPECT_EQ(vault_->Setup(key_, /*create=*/true), MOUNT_ERROR_KEYRING_FAILED);
  ExpectVaultTeardownOnDestruction();
}

// Tests the failure path on Setup if setting up the container fails.
TEST_P(CryptohomeVaultTest, MigratingContainerSetupFailed) {
  GenerateVault(/*create_container=*/false,
                /*create_migrating_container=*/false,
                /*create_cache_container=*/false);
  ExpectVaultSetup();
  ExpectContainerSetup(ContainerType());
  ExpectCacheContainerSetup(CacheContainerType());

  // In absence of a migrating container, the vault setup should succeed.
  MountError error =
      MigratingContainerType() != EncryptedContainerType::kUnknown
          ? MOUNT_ERROR_KEYRING_FAILED
          : MOUNT_ERROR_NONE;

  EXPECT_EQ(vault_->Setup(key_, /*create=*/true), error);
  ExpectVaultTeardownOnDestruction();
}

// Tests the setup path of a pristine cryptohome.
TEST_P(CryptohomeVaultTest, CreateVault) {
  GenerateVault(/*create_container=*/false,
                /*create_migrating_container=*/false,
                /*create_cache_container=*/false);
  ExpectVaultSetup();
  ExpectContainerSetup(ContainerType());
  ExpectContainerSetup(MigratingContainerType());
  ExpectCacheContainerSetup(CacheContainerType());

  EXPECT_EQ(vault_->Setup(key_, /*create=*/true), MOUNT_ERROR_NONE);

  CheckContainersExist();
  ExpectVaultTeardownOnDestruction();
}

// Tests the setup path for an existing container with no migrating container
// setup.
TEST_P(CryptohomeVaultTest, ExistingVaultNoMigratingVault) {
  GenerateVault(/*create_container=*/true,
                /*create_migrating_container=*/false,
                /*create_cache_container=*/false);
  ExpectVaultSetup();
  ExpectContainerSetup(ContainerType());
  ExpectContainerSetup(MigratingContainerType());
  ExpectCacheContainerSetup(CacheContainerType());

  EXPECT_EQ(vault_->Setup(key_, /*create=*/false), MOUNT_ERROR_NONE);

  CheckContainersExist();
  ExpectVaultTeardownOnDestruction();
}

// Tests the setup path for an existing vault with an existing migrating
// container (incomplete migration).
TEST_P(CryptohomeVaultTest, ExistingMigratingVault) {
  GenerateVault(/*create_container=*/true, /*create_migrating_container=*/true,
                /*create_cache_container=*/false);
  ExpectVaultSetup();
  ExpectContainerSetup(ContainerType());
  ExpectContainerSetup(MigratingContainerType());
  ExpectCacheContainerSetup(CacheContainerType());

  EXPECT_EQ(vault_->Setup(key_, /*create=*/false), MOUNT_ERROR_NONE);

  CheckContainersExist();
  ExpectVaultTeardownOnDestruction();
}

// Tests the setup path for an existing vault with an existing cache container
// (incomplete migration).
TEST_P(CryptohomeVaultTest, ExistingCacheContainer) {
  GenerateVault(/*create_container=*/true, /*create_migrating_container=*/false,
                /*create_cache_container=*/true);
  ExpectVaultSetup();
  ExpectContainerSetup(ContainerType());
  ExpectContainerSetup(MigratingContainerType());
  ExpectCacheContainerSetup(CacheContainerType());

  EXPECT_EQ(vault_->Setup(key_, /*create=*/false), MOUNT_ERROR_NONE);

  CheckContainersExist();
  ExpectVaultTeardownOnDestruction();
}

}  // namespace cryptohome