/*
 * Copyright (c) 2015-2016 Isode Limited.
 * All rights reserved.
 * See the COPYING file for more information.
 */

 /*
	This file uses http://www.tls-o-matic.com/ to test the currently configured TLS backend for correct certificate validation behavior.
 */

#include <cppunit/extensions/HelperMacros.h>
#include <cppunit/extensions/TestFactoryRegistry.h>

#include <Swiften/Base/Log.h>
#include <Swiften/EventLoop/DummyEventLoop.h>
#include <Swiften/IDN/IDNConverter.h>
#include <Swiften/IDN/PlatformIDNConverter.h>
#include <Swiften/Network/BoostConnectionFactory.h>
#include <Swiften/Network/BoostIOServiceThread.h>
#include <Swiften/Network/HostAddressPort.h>
#include <Swiften/Network/PlatformDomainNameResolver.h>
#include <Swiften/Network/TLSConnection.h>
#include <Swiften/Network/TLSConnectionFactory.h>
#include <Swiften/TLS/CertificateVerificationError.h>
#include <Swiften/TLS/PlatformTLSFactories.h>
#include <Swiften/TLS/TLSContext.h>
#include <Swiften/TLS/TLSContextFactory.h>

using namespace Swift;

class CertificateErrorTest : public CppUnit::TestFixture {
		CPPUNIT_TEST_SUITE(CertificateErrorTest);

		// These test require the TLS-O-Matic testing CA to be trusted. For more info see https://www.tls-o-matic.com/https/test1 .
		CPPUNIT_TEST(testTLS_O_MaticTrusted);
		CPPUNIT_TEST(testTLS_O_MaticCertificateFromTheFuture);
		CPPUNIT_TEST(testTLS_O_MaticCertificateFromThePast);
		CPPUNIT_TEST(testTLS_O_MaticCertificateFromUnknownCA);
		CPPUNIT_TEST(testTLS_O_MaticCertificateWrongPurpose);

#if !defined(HAVE_OPENSSL)
		// Our OpenSSL backend does not support revocation. We excluded it from the revocation tests.
		CPPUNIT_TEST(testRevokedCertificateRevocationDisabled);
		CPPUNIT_TEST(testRevokedCertificateRevocationEnabled);
#endif

		CPPUNIT_TEST_SUITE_END();

	public:
		void setUp() {
			eventLoop_ = new DummyEventLoop();
			boostIOServiceThread_ = new BoostIOServiceThread();
			boostIOService_ = boost::make_shared<boost::asio::io_service>();
			connectionFactory_ = new BoostConnectionFactory(boostIOServiceThread_->getIOService(), eventLoop_);
			idnConverter_ = PlatformIDNConverter::create();
			domainNameResolver_ = new PlatformDomainNameResolver(idnConverter_, eventLoop_);

			tlsFactories_ = new PlatformTLSFactories();
			tlsContextFactory_ = tlsFactories_->getTLSContextFactory();
			
			tlsContextFactory_->setCheckCertificateRevocation(false);

			tlsConnectionFactory_ = new TLSConnectionFactory(tlsContextFactory_, connectionFactory_, TLSOptions());

			connectFinished_ = false;
			connectFinishedWithError_ = false;
		}

		void tearDown() {
			delete tlsConnectionFactory_;
			delete tlsFactories_;

			delete domainNameResolver_;
			delete idnConverter_;
			delete connectionFactory_;
			delete boostIOServiceThread_;
			while (eventLoop_->hasEvents()) {
				eventLoop_->processEvents();
			}
			delete eventLoop_;
		}

		HostAddress resolveName(const std::string& name) {
			boost::shared_ptr<DomainNameAddressQuery> query = domainNameResolver_->createAddressQuery(name);
			query->onResult.connect(boost::bind(&CertificateErrorTest::handleAddressQueryResult, this, _1, _2));
			lastResoverResult_ = HostAddress();
			resolvingDone_ = false;
			
			query->run();
			while(!resolvingDone_) {
				eventLoop_->processEvents();
			}

			return lastResoverResult_;
		}

		void connectToServer(boost::shared_ptr<TLSConnection> connection, const std::string& hostname, int port) {
			connection->onConnectFinished.connect(boost::bind(&CertificateErrorTest::handleConnectFinished, this, _1));

			HostAddress address = resolveName(hostname);

			connection->connect(HostAddressPort(address, port));

			while (!connectFinished_) {
				eventLoop_->processEvents();
			}
		}

		void testTLS_O_MaticTrusted() {
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "test1.tls-o-matic.com", 443);
	
			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::ref(), context->getPeerCertificateVerificationError());
		}

		void testTLS_O_MaticCertificateFromTheFuture() {
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "test5.tls-o-matic.com", 405);

			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT(context->getPeerCertificateVerificationError());
#if defined(HAVE_SCHANNEL)
			// Windows SChannel API does not differentiate between expired and not yet valid.
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::Expired, context->getPeerCertificateVerificationError()->getType());
#else
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::NotYetValid, context->getPeerCertificateVerificationError()->getType());
#endif
		}

		void testTLS_O_MaticCertificateFromThePast() {
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "test6.tls-o-matic.com", 406);

			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT(context->getPeerCertificateVerificationError());
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::Expired, context->getPeerCertificateVerificationError()->getType());
		}

		void testTLS_O_MaticCertificateFromUnknownCA() {
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "test7.tls-o-matic.com", 407);

			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT(context->getPeerCertificateVerificationError());
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::Untrusted, context->getPeerCertificateVerificationError()->getType());
		}

		// test14.tls-o-matic.com:414
		void testTLS_O_MaticCertificateWrongPurpose() {
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "test14.tls-o-matic.com", 414);

			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT(context->getPeerCertificateVerificationError());
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::InvalidPurpose, context->getPeerCertificateVerificationError()->getType());
		}

		void testRevokedCertificateRevocationDisabled() {
			tlsContextFactory_->setCheckCertificateRevocation(false);
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "revoked.grc.com", 443);

			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT(!context->getPeerCertificateVerificationError());
		}

		void testRevokedCertificateRevocationEnabled() {
			tlsContextFactory_->setCheckCertificateRevocation(true);
			boost::shared_ptr<TLSConnection> connection = boost::dynamic_pointer_cast<TLSConnection>(tlsConnectionFactory_->createConnection());
			TLSContext* context = connection->getTLSContext();

			connectToServer(connection, "revoked.grc.com", 443);

			CPPUNIT_ASSERT_EQUAL(false, connectFinishedWithError_);
			CPPUNIT_ASSERT(context->getPeerCertificateVerificationError());
			CPPUNIT_ASSERT_EQUAL(CertificateVerificationError::Revoked, context->getPeerCertificateVerificationError()->getType());
		}

	private:
		void handleAddressQueryResult(const std::vector<HostAddress>& address, boost::optional<DomainNameResolveError> /* error */) {
			if (address.size() > 0) {
				lastResoverResult_ = address[0];
			}
			resolvingDone_ = true;
		}

		void handleConnectFinished(bool error) {
			connectFinished_ = true;
			connectFinishedWithError_ = error;
		}
	
	private:
		BoostIOServiceThread* boostIOServiceThread_;
		boost::shared_ptr<boost::asio::io_service> boostIOService_;
		DummyEventLoop* eventLoop_;
		ConnectionFactory* connectionFactory_;
		PlatformTLSFactories* tlsFactories_;
		TLSContextFactory* tlsContextFactory_;
		TLSConnectionFactory* tlsConnectionFactory_;
		
		IDNConverter* idnConverter_;
		DomainNameResolver* domainNameResolver_;
		HostAddress lastResoverResult_;
		bool resolvingDone_;

		bool connectFinished_;
		bool connectFinishedWithError_;
};


CPPUNIT_TEST_SUITE_REGISTRATION(CertificateErrorTest);