/* GIO TLS tests
 *
 * Copyright 2011 Collabora, Ltd.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General
 * Public License along with this library; if not, see
 * <http://www.gnu.org/licenses/>.
 *
 * In addition, when the library is used with OpenSSL, a special
 * exception applies. Refer to the LICENSE_EXCEPTION file for details.
 *
 * Author: Stef Walter <stefw@collabora.co.uk>
 */

#include "config.h"

#include <gio/gio.h>

#include "gnutls/gtlscertificate-gnutls.h"

#include <sys/types.h>
#include <string.h>

static const gchar *
tls_test_file_path (const char *name)
{
  const gchar *const_path;
  gchar *path;

  path = g_test_build_filename (G_TEST_DIST, "files", name, NULL);
  if (!g_path_is_absolute (path))
    {
      gchar *cwd, *abs;

      cwd = g_get_current_dir ();
      abs = g_build_filename (cwd, path, NULL);
      g_free (cwd);
      g_free (path);
      path = abs;
    }

  const_path = g_intern_string (path);
  g_free (path);
  return const_path;
}

/* -----------------------------------------------------------------------------
 * CERTIFICATE VERIFY
 */

typedef struct {
  GTlsCertificate *cert;
  GSocketConnectable *identity;
  GTlsDatabase *database;
} TestVerify;

static void
setup_verify (TestVerify     *test,
              gconstpointer   data)
{
  GError *error = NULL;

  test->cert = g_tls_certificate_new_from_file (tls_test_file_path ("server.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (test->cert));

  test->identity = g_network_address_new ("server.example.com", 80);

  test->database = g_tls_file_database_new (tls_test_file_path ("ca.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_DATABASE (test->database));
}

static void
teardown_verify (TestVerify      *test,
                 gconstpointer    data)
{
  g_assert (G_IS_TLS_CERTIFICATE (test->cert));
  g_object_add_weak_pointer (G_OBJECT (test->cert),
			     (gpointer *)&test->cert);
  g_object_unref (test->cert);
  g_assert (test->cert == NULL);

  g_assert (G_IS_TLS_DATABASE (test->database));
  g_object_add_weak_pointer (G_OBJECT (test->database),
			     (gpointer *)&test->database);
  g_object_unref (test->database);
  g_assert (test->database == NULL);

  g_object_add_weak_pointer (G_OBJECT (test->identity),
			     (gpointer *)&test->identity);
  g_object_unref (test->identity);
  g_assert (test->identity == NULL);
}

static void
test_verify_database_good (TestVerify      *test,
                           gconstpointer    data)
{
  GTlsCertificateFlags errors;
  GError *error = NULL;

  errors = g_tls_database_verify_chain (test->database, test->cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        test->identity, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  g_assert_cmpuint (errors, ==, 0);

  errors = g_tls_database_verify_chain (test->database, test->cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        NULL, NULL, 0, NULL, &error);
  g_assert_cmpuint (errors, ==, 0);
}

static void
test_verify_database_bad_identity (TestVerify      *test,
                                   gconstpointer    data)
{
  GSocketConnectable *identity;
  GTlsCertificateFlags errors;
  GError *error = NULL;

  identity = g_network_address_new ("other.example.com", 80);

  errors = g_tls_database_verify_chain (test->database, test->cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        identity, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_BAD_IDENTITY);

  g_object_unref (identity);
}

static void
test_verify_database_bad_ca (TestVerify      *test,
                             gconstpointer    data)
{
  GTlsCertificateFlags errors;
  GTlsCertificate *cert;
  GError *error = NULL;

  /* Use another certificate which isn't in our CA list */
  cert = g_tls_certificate_new_from_file (tls_test_file_path ("server-self.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (cert));

  errors = g_tls_database_verify_chain (test->database, cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        test->identity, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_UNKNOWN_CA);

  g_object_unref (cert);
}

static void
test_verify_database_bad_before (TestVerify      *test,
                                 gconstpointer    data)
{
  GTlsCertificateFlags errors;
  GTlsCertificate *cert;
  GError *error = NULL;

  /* This is a certificate in the future */
  cert = g_tls_certificate_new_from_file (tls_test_file_path ("client-future.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (cert));

  errors = g_tls_database_verify_chain (test->database, cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        NULL, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_NOT_ACTIVATED);

  g_object_unref (cert);
}

static void
test_verify_database_bad_expired (TestVerify      *test,
                                  gconstpointer    data)
{
  GTlsCertificateFlags errors;
  GTlsCertificate *cert;
  GError *error = NULL;

  /* This is a certificate in the future */
  cert = g_tls_certificate_new_from_file (tls_test_file_path ("client-past.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (cert));

  errors = g_tls_database_verify_chain (test->database, cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        NULL, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_EXPIRED);

  g_object_unref (cert);
}

static void
test_verify_database_bad_combo (TestVerify      *test,
                                gconstpointer    data)
{
  GTlsCertificate *cert;
  GSocketConnectable *identity;
  GTlsCertificateFlags errors;
  GError *error = NULL;

  cert = g_tls_certificate_new_from_file (tls_test_file_path ("server-self.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (cert));

  /*
   * - Use is self signed
   * - Use wrong identity.
   */

  identity = g_network_address_new ("other.example.com", 80);

  errors = g_tls_database_verify_chain (test->database, cert,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        identity, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_UNKNOWN_CA |
                    G_TLS_CERTIFICATE_BAD_IDENTITY);

  g_object_unref (cert);
  g_object_unref (identity);
}

static GTlsCertificate *
load_certificate_chain (const char  *filename,
                        GError     **error)
{
  GList *certificates;
  GTlsCertificate *chain = NULL, *prev_chain = NULL;
  GTlsBackend *backend;
  GByteArray *der;
  GList *l;

  certificates = g_tls_certificate_list_new_from_file (filename, error);
  if (certificates == NULL)
    return NULL;

  backend = g_tls_backend_get_default ();
  certificates = g_list_reverse (certificates);
  for (l = certificates; l != NULL; l = g_list_next (l))
    {
      prev_chain = chain;
      g_object_get (l->data, "certificate", &der, NULL);
      chain = g_object_new (g_tls_backend_get_certificate_type (backend),
                            "certificate", der,
                            "issuer", prev_chain,
                            NULL);
      g_byte_array_unref (der);
      g_clear_object (&prev_chain);
    }

  g_list_free_full (certificates, g_object_unref);
  return chain;
}

static gboolean
is_certificate_in_chain (GTlsCertificate *chain,
                         GTlsCertificate *cert)
{
  while (chain != NULL)
    {
      if (g_tls_certificate_is_same (chain, cert))
        return TRUE;
      chain = g_tls_certificate_get_issuer (chain);
    }

  return FALSE;
}

static void
test_verify_with_incorrect_root_in_chain (void)
{
  GTlsCertificate *ca_verisign_sha1;
  GTlsDatabase *database;
  GError *error = NULL;
  GTlsCertificate *chain;
  GSocketConnectable *identity;
  GTlsCertificateFlags errors;

  /*
   * This database contains a single anchor certificate of:
   * C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
   */
  database = g_tls_file_database_new (tls_test_file_path ("ca-verisign-sha1.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_DATABASE (database));

  ca_verisign_sha1 = g_tls_certificate_new_from_file (tls_test_file_path ("ca-verisign-sha1.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (ca_verisign_sha1));

  /*
   * This certificate chain contains a root certificate with that same issuer, public key:
   * C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
   *
   * But it is not the same certificate in our database. However our database should
   * verify this chain as valid, since the issuer fields and signatures should chain up
   * to the certificate in our database.
   */
  chain = load_certificate_chain (tls_test_file_path ("chain-with-verisign-md2.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (chain));

  g_assert (g_tls_certificate_get_issuer (chain) != NULL);
  g_assert (g_tls_certificate_get_issuer (g_tls_certificate_get_issuer (chain)) != NULL);
  g_assert (is_certificate_in_chain (chain, chain));
  g_assert (!is_certificate_in_chain (chain, ca_verisign_sha1));


  identity = g_network_address_new ("secure-test.streamline-esolutions.com", 443);

  errors = g_tls_database_verify_chain (database, chain,
                                        G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
                                        identity, NULL, 0, NULL, &error);
  g_assert_no_error (error);
  errors &= ~G_TLS_CERTIFICATE_EXPIRED; /* so that this test doesn't expire */
  g_assert_cmpuint (errors, ==, 0);

  g_object_unref (chain);
  g_object_unref (ca_verisign_sha1);
  g_object_unref (identity);
  g_object_unref (database);
}

/* -----------------------------------------------------------------------------
 * FILE DATABASE
 */

typedef struct {
  GTlsDatabase *database;
  const gchar *path;
} TestFileDatabase;

static void
setup_file_database (TestFileDatabase *test,
                     gconstpointer     data)
{
  GError *error = NULL;

  test->path = tls_test_file_path ("ca-roots.pem");
  test->database = g_tls_file_database_new (test->path, &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_DATABASE (test->database));
}

static void
teardown_file_database (TestFileDatabase *test,
                        gconstpointer     data)
{
  g_assert (G_IS_TLS_DATABASE (test->database));
  g_object_add_weak_pointer (G_OBJECT (test->database),
			     (gpointer *)&test->database);
  g_object_unref (test->database);
  g_assert (test->database == NULL);
}

static void
test_file_database_handle (TestFileDatabase *test,
                           gconstpointer     unused)
{
  GTlsCertificate *certificate;
  GTlsCertificate *check;
  GError *error = NULL;
  gchar *handle;

  /*
   * ca.pem is in the ca-roots.pem that the test->database represents.
   * So it should be able to create a handle for it and treat it as if it
   * is 'in' the database.
   */

  certificate = g_tls_certificate_new_from_file (tls_test_file_path ("ca.pem"), &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (certificate));

  handle = g_tls_database_create_certificate_handle (test->database, certificate);
  g_assert (handle != NULL);
  g_assert (g_str_has_prefix (handle, "file:///"));

  check = g_tls_database_lookup_certificate_for_handle (test->database, handle,
                                                        NULL, G_TLS_DATABASE_LOOKUP_NONE,
                                                        NULL, &error);
  g_assert_no_error (error);
  g_assert (G_IS_TLS_CERTIFICATE (check));

  g_free (handle);
  g_object_unref (check);
  g_object_unref (certificate);
}

static void
test_file_database_handle_invalid (TestFileDatabase *test,
                                   gconstpointer     unused)
{
  GTlsCertificate *certificate;
  GError *error = NULL;

  certificate = g_tls_database_lookup_certificate_for_handle (test->database, "blah:blah",
                                                              NULL, G_TLS_DATABASE_LOOKUP_NONE,
                                                              NULL, &error);
  g_assert_no_error (error);
  g_assert (certificate == NULL);
}

/* -----------------------------------------------------------------------------
 * DATABASE
 */

static void
test_anchors_property (void)
{
  GTlsDatabase *database;
  gchar *anchor_filename = NULL;
  GError *error = NULL;

  database = g_tls_file_database_new (tls_test_file_path ("ca.pem"), &error);
  g_assert_no_error (error);

  g_object_get (database, "anchors", &anchor_filename, NULL);
  g_assert_cmpstr (anchor_filename, ==, tls_test_file_path ("ca.pem"));
  g_free (anchor_filename);

  g_object_unref (database);
}

static gboolean
certificate_is_in_list (GList *certificates,
                        const gchar *filename)
{
  GTlsCertificate *cert;
  GError *error = NULL;
  GList *l;

  cert = g_tls_certificate_new_from_file (filename, &error);
  g_assert_no_error (error);

  for (l = certificates; l != NULL; l = g_list_next (l))
    {
      if (g_tls_certificate_is_same (l->data, cert))
        break;
    }

  g_object_unref (cert);

  /* Had an early break from loop */
  return l != NULL;
}

static void
test_lookup_certificates_issued_by (void)
{
  /* This data is generated from the frob-certificate test tool in gcr library.
   * To regenerate (from e.g. a directory containing gcr and glib-networking):
   *
   * $ gcr/frob-certificate glib-networking/tls/tests/files/ca.pem
   *
   * Then copy the hex that is printed after "subject" (not "issuer"!) and add
   * the missing 'x's.
   */
  const guchar ISSUER[] = "\x30\x81\x86\x31\x13\x30\x11\x06\x0A\x09\x92\x26\x89\x93\xF2"
                          "\x2C\x64\x01\x19\x16\x03\x43\x4F\x4D\x31\x17\x30\x15\x06\x0A"
                          "\x09\x92\x26\x89\x93\xF2\x2C\x64\x01\x19\x16\x07\x45\x58\x41"
                          "\x4D\x50\x4C\x45\x31\x1E\x30\x1C\x06\x03\x55\x04\x0B\x0C\x15"
                          "\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x20\x41\x75\x74"
                          "\x68\x6F\x72\x69\x74\x79\x31\x17\x30\x15\x06\x03\x55\x04\x03"
                          "\x0C\x0E\x63\x61\x2E\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F"
                          "\x6D\x31\x1D\x30\x1B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x09"
                          "\x01\x16\x0E\x63\x61\x40\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63"
                          "\x6F\x6D";

  GList *certificates;
  GByteArray *issuer_dn;
  GTlsDatabase *database;
  GError *error = NULL;

  database = g_tls_file_database_new (tls_test_file_path ("non-ca.pem"), &error);
  g_assert_no_error (error);

  issuer_dn = g_byte_array_new ();
  /* The null terminator is in the array/string above */
  g_byte_array_append (issuer_dn, ISSUER, G_N_ELEMENTS (ISSUER) - 1);

  certificates = g_tls_database_lookup_certificates_issued_by (database, issuer_dn, NULL,
                                                               G_TLS_DATABASE_LOOKUP_NONE,
                                                               NULL, &error);

  g_byte_array_unref (issuer_dn);

  g_assert_cmpuint (g_list_length (certificates), ==, 4);

  g_assert (certificate_is_in_list (certificates, tls_test_file_path ("client.pem")));
  g_assert (certificate_is_in_list (certificates, tls_test_file_path ("client-future.pem")));
  g_assert (certificate_is_in_list (certificates, tls_test_file_path ("client-past.pem")));
  g_assert (certificate_is_in_list (certificates, tls_test_file_path ("server.pem")));
  g_assert (!certificate_is_in_list (certificates, tls_test_file_path ("server-self.pem")));

  g_list_free_full (certificates, g_object_unref);
  g_object_unref (database);
}

static void
test_default_database_is_singleton (void)
{
  GTlsBackend *backend;
  GTlsDatabase *database;
  GTlsDatabase *check;

  backend = g_tls_backend_get_default ();
  g_assert (G_IS_TLS_BACKEND (backend));

  database = g_tls_backend_get_default_database (backend);
  g_assert (G_IS_TLS_DATABASE (database));

  check = g_tls_backend_get_default_database (backend);
  g_assert (database == check);

  g_object_unref (database);
  g_object_unref (check);
}

int
main (int   argc,
      char *argv[])
{
  g_test_init (&argc, &argv, NULL);

  g_setenv ("GSETTINGS_BACKEND", "memory", TRUE);
  g_setenv ("GIO_EXTRA_MODULES", TOP_BUILDDIR "/tls/gnutls/.libs", TRUE);
  g_setenv ("GIO_USE_TLS", "gnutls", TRUE);

  g_test_add_func ("/tls/backend/default-database-is-singleton",
                   test_default_database_is_singleton);

  g_test_add ("/tls/database/verify-good", TestVerify, NULL,
              setup_verify, test_verify_database_good, teardown_verify);
  g_test_add ("/tls/database/verify-bad-identity", TestVerify, NULL,
              setup_verify, test_verify_database_bad_identity, teardown_verify);
  g_test_add ("/tls/database/verify-bad-ca", TestVerify, NULL,
              setup_verify, test_verify_database_bad_ca, teardown_verify);
  g_test_add ("/tls/database/verify-bad-before", TestVerify, NULL,
              setup_verify, test_verify_database_bad_before, teardown_verify);
  g_test_add ("/tls/database/verify-bad-expired", TestVerify, NULL,
              setup_verify, test_verify_database_bad_expired, teardown_verify);
  g_test_add ("/tls/database/verify-bad-combo", TestVerify, NULL,
              setup_verify, test_verify_database_bad_combo, teardown_verify);
  g_test_add_func ("/tls/database/verify-with-incorrect-root-in-chain",
                   test_verify_with_incorrect_root_in_chain);

  g_test_add_func ("/tls/file-database/anchors-property",
                   test_anchors_property);
  g_test_add_func ("/tls/file-database/lookup-certificates-issued-by",
                   test_lookup_certificates_issued_by);

  g_test_add ("/tls/file-database/test-handle", TestFileDatabase, NULL,
              setup_file_database, test_file_database_handle, teardown_file_database);
  g_test_add ("/tls/file-database/test-handle-invalid", TestFileDatabase, NULL,
              setup_file_database, test_file_database_handle_invalid, teardown_file_database);

  return g_test_run();
}