/*
 * Copyright (C) 2016 Red Hat, Inc.
 *
 * Authors: Nikos Mavrogiannopoulos, Martin Ukrop
 *
 * This file is part of GnuTLS.
 *
 * GnuTLS is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * GnuTLS is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with GnuTLS; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
 */

#include <config.h>
#include <stdarg.h>
#include <stddef.h>
#include <setjmp.h>
#include <limits.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <arpa/inet.h>
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>

#ifndef _WIN32
# include <cmocka.h>
# include <sys/socket.h>

#define BUILD_IN_TESTS
#include "../lib/x509/ip-in-cidr.h"

#define _MATCH_FUNC(fname, CIDR, IP, status) \
static void fname(void **glob_state) \
{ \
	gnutls_datum_t dcidr; \
	const char cidr[] = CIDR; \
	const char ip[] = IP; \
	char xip[4]; \
	gnutls_datum_t dip = {(unsigned char*)xip, sizeof(xip)}; \
	assert_int_equal(gnutls_x509_cidr_to_rfc5280(cidr, &dcidr), 0); \
	assert_int_equal(inet_pton(AF_INET, ip, xip), 1); \
	assert_int_equal(ip_in_cidr(&dip, &dcidr), status); \
	gnutls_free(dcidr.data); \
}

#define MATCH_FUNC_OK(fname, CIDR, IP) _MATCH_FUNC(fname, CIDR, IP, 1)
#define MATCH_FUNC_NOT_OK(fname, CIDR, IP) _MATCH_FUNC(fname, CIDR, IP, 0)

MATCH_FUNC_OK(check_ip1_match, "192.168.1.0/24", "192.168.1.128");
MATCH_FUNC_OK(check_ip2_match, "192.168.1.0/24", "192.168.1.1");
MATCH_FUNC_OK(check_ip3_match, "192.168.1.0/24", "192.168.1.0");
MATCH_FUNC_OK(check_ip4_match, "192.168.1.0/28", "192.168.1.0");
MATCH_FUNC_OK(check_ip5_match, "192.168.1.0/28", "192.168.1.14");

MATCH_FUNC_NOT_OK(check_ip1_not_match, "192.168.1.0/24", "192.168.2.128");
MATCH_FUNC_NOT_OK(check_ip2_not_match, "192.168.1.0/24", "192.168.128.1");
MATCH_FUNC_NOT_OK(check_ip3_not_match, "192.168.1.0/24", "193.168.1.0");
MATCH_FUNC_NOT_OK(check_ip4_not_match, "192.168.1.0/28", "192.168.1.16");
MATCH_FUNC_NOT_OK(check_ip5_not_match, "192.168.1.0/28", "192.168.1.64");
MATCH_FUNC_NOT_OK(check_ip6_not_match, "192.168.1.0/24", "10.0.0.0");
MATCH_FUNC_NOT_OK(check_ip7_not_match, "192.168.1.0/24", "192.169.1.0");

#define CIDR_MATCH(fname, CIDR, EXPECTED) \
static void fname(void **glob_state) \
{ \
	gnutls_datum_t dcidr; \
	const char cidr[] = CIDR; \
	assert_int_equal(gnutls_x509_cidr_to_rfc5280(cidr, &dcidr), 0); \
	assert_memory_equal(EXPECTED, dcidr.data, dcidr.size); \
	gnutls_free(dcidr.data); \
}

#define CIDR_FAIL(fname, CIDR) \
static void fname(void **glob_state) \
{ \
	gnutls_datum_t dcidr; \
	const char cidr[] = CIDR; \
	assert_int_not_equal(gnutls_x509_cidr_to_rfc5280(cidr, &dcidr), 0); \
}

CIDR_MATCH(check_cidr_ok1, "0.0.0.0/32","\x00\x00\x00\x00\xff\xff\xff\xff");
CIDR_MATCH(check_cidr_ok2, "192.168.1.1/12", "\xc0\xa0\x00\x00\xff\xf0\x00\x00");
CIDR_MATCH(check_cidr_ok3, "192.168.1.1/0", "\x00\x00\x00\x00\x00\x00\x00\x00");
CIDR_MATCH(check_cidr_ok4, "::/19", "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00");
CIDR_MATCH(check_cidr_ok5, "::1/128", "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff");
CIDR_MATCH(check_cidr_ok6, "2001:db8::/48", "\x20\x01\x0d\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00");

CIDR_FAIL(check_cidr_fail1, "0.0.0.0/100");
CIDR_FAIL(check_cidr_fail2, "1.2.3.4/-1");
CIDR_FAIL(check_cidr_fail3, "1.300.3.4/-1");
CIDR_FAIL(check_cidr_fail4, "1.2.3/-1");
CIDR_FAIL(check_cidr_fail5, "1.2.3.4.5/-1");
CIDR_FAIL(check_cidr_fail6, "1.2.3.4");
CIDR_FAIL(check_cidr_fail7, ":://128");
CIDR_FAIL(check_cidr_fail8, "192.168.1.1/");
CIDR_FAIL(check_cidr_fail9, "192.168.1.1/33");
CIDR_FAIL(check_cidr_fail10, "::/");
CIDR_FAIL(check_cidr_fail11, "::/129");

int main(void)
{
	const struct CMUnitTest tests[] = {
		cmocka_unit_test(check_ip1_match),
		cmocka_unit_test(check_ip2_match),
		cmocka_unit_test(check_ip3_match),
		cmocka_unit_test(check_ip4_match),
		cmocka_unit_test(check_ip5_match),
		cmocka_unit_test(check_ip1_not_match),
		cmocka_unit_test(check_ip2_not_match),
		cmocka_unit_test(check_ip3_not_match),
		cmocka_unit_test(check_ip4_not_match),
		cmocka_unit_test(check_ip5_not_match),
		cmocka_unit_test(check_ip6_not_match),
		cmocka_unit_test(check_ip7_not_match),

		cmocka_unit_test(check_cidr_ok1),
		cmocka_unit_test(check_cidr_ok2),
		cmocka_unit_test(check_cidr_ok3),
		cmocka_unit_test(check_cidr_ok4),
		cmocka_unit_test(check_cidr_ok5),
		cmocka_unit_test(check_cidr_ok6),

		cmocka_unit_test(check_cidr_fail1),
		cmocka_unit_test(check_cidr_fail2),
		cmocka_unit_test(check_cidr_fail3),
		cmocka_unit_test(check_cidr_fail4),
		cmocka_unit_test(check_cidr_fail5),
		cmocka_unit_test(check_cidr_fail6),
		cmocka_unit_test(check_cidr_fail7),
		cmocka_unit_test(check_cidr_fail8),
		cmocka_unit_test(check_cidr_fail9),
		cmocka_unit_test(check_cidr_fail10),
		cmocka_unit_test(check_cidr_fail11),
	};
	return cmocka_run_group_tests(tests, NULL, NULL);
}
#else
int main(void)
{
	exit(77);
}
#endif