// Copyright 2021 CNI authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package link_test

import (
	"errors"
	"fmt"

	"github.com/networkplumbing/go-nft/nft"
	. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"

	"github.com/containernetworking/plugins/pkg/link"
)

var _ = Describe("spoofcheck", func() {
	iface := "net0"
	mac := "02:00:00:00:12:34"
	id := "container99-net1"

	Context("setup", func() {
		It("succeeds", func() {
			c := configurerStub{}
			sc := link.NewSpoofCheckerWithConfigurer(iface, mac, id, &c)
			Expect(sc.Setup()).To(Succeed())

			assertExpectedTableAndChainsInSetupConfig(c)
			assertExpectedRulesInSetupConfig(c)
		})

		It("fails to setup config when 1st apply is unsuccessful (declare table and chains)", func() {
			c := &configurerStub{failFirstApplyConfig: true}
			sc := link.NewSpoofCheckerWithConfigurer(iface, mac, id, c)
			Expect(sc.Setup()).To(MatchError("failed to setup spoof-check: " + errorFirstApplyText))
		})

		It("fails to setup config when 2nd apply is unsuccessful (flush and add the rules)", func() {
			c := &configurerStub{failSecondApplyConfig: true}
			sc := link.NewSpoofCheckerWithConfigurer(iface, mac, id, c)
			Expect(sc.Setup()).To(MatchError("failed to setup spoof-check: " + errorSecondApplyText))
		})
	})

	Context("teardown", func() {
		It("succeeds", func() {
			existingConfig := nft.NewConfig()
			existingConfig.FromJSON([]byte(rowConfigWithRulesOnly()))
			c := configurerStub{readConfig: existingConfig}

			sc := link.NewSpoofCheckerWithConfigurer("", "", id, &c)
			Expect(sc.Teardown()).To(Succeed())

			assertExpectedBaseChainRuleDeletionInTeardownConfig(c)
			assertExpectedRegularChainsDeletionInTeardownConfig(c)
		})

		It("fails, 1st apply is unsuccessful (delete iface match rule)", func() {
			config := nft.NewConfig()
			config.FromJSON([]byte(rowConfigWithRulesOnly()))
			c := &configurerStub{applyConfig: []*nft.Config{config}, readConfig: config, failFirstApplyConfig: true}
			sc := link.NewSpoofCheckerWithConfigurer("", "", id, c)
			Expect(sc.Teardown()).To(MatchError(fmt.Sprintf(
				"failed to teardown spoof-check: failed to delete iface match rule: %s, <nil>", errorFirstApplyText,
			)))
		})

		It("fails, read current config is unsuccessful", func() {
			config := nft.NewConfig()
			config.FromJSON([]byte(rowConfigWithRulesOnly()))
			c := &configurerStub{applyConfig: []*nft.Config{config}, readConfig: config, failReadConfig: true}
			sc := link.NewSpoofCheckerWithConfigurer("", "", id, c)
			Expect(sc.Teardown()).To(MatchError(fmt.Sprintf(
				"failed to teardown spoof-check: %s, <nil>", errorReadText,
			)))
		})

		It("fails, 2nd apply is unsuccessful (delete the regular chains)", func() {
			config := nft.NewConfig()
			config.FromJSON([]byte(rowConfigWithRulesOnly()))
			c := &configurerStub{applyConfig: []*nft.Config{config}, readConfig: config, failSecondApplyConfig: true}
			sc := link.NewSpoofCheckerWithConfigurer("", "", id, c)
			Expect(sc.Teardown()).To(MatchError(fmt.Sprintf(
				"failed to teardown spoof-check: <nil>, failed to delete regular chains: %s", errorSecondApplyText,
			)))
		})

		It("fails, both applies are unsuccessful", func() {
			config := nft.NewConfig()
			config.FromJSON([]byte(rowConfigWithRulesOnly()))
			c := &configurerStub{
				applyConfig:           []*nft.Config{config},
				readConfig:            config,
				failFirstApplyConfig:  true,
				failSecondApplyConfig: true,
			}
			sc := link.NewSpoofCheckerWithConfigurer("", "", id, c)
			Expect(sc.Teardown()).To(MatchError(fmt.Sprintf(
				"failed to teardown spoof-check: "+
					"failed to delete iface match rule: %s, "+
					"failed to delete regular chains: %s",
				errorFirstApplyText, errorSecondApplyText,
			)))
		})
	})

	Context("echo", func() {
		It("succeeds, no read called", func() {
			c := configurerStub{}
			sc := link.NewSpoofCheckerWithConfigurer(iface, mac, id, &c)
			Expect(sc.Setup()).To(Succeed())
			Expect(sc.Teardown()).To(Succeed())
			Expect(c.readCalled).To(BeFalse())
		})

		It("succeeds, fall back to config read", func() {
			c := configurerStub{applyReturnNil: true}
			sc := link.NewSpoofCheckerWithConfigurer(iface, mac, id, &c)
			Expect(sc.Setup()).To(Succeed())
			c.readConfig = c.applyConfig[0]
			Expect(sc.Teardown()).To(Succeed())
			Expect(c.readCalled).To(BeTrue())
		})
	})
})

func assertExpectedRegularChainsDeletionInTeardownConfig(action configurerStub) {
	deleteRegularChainRulesJSONConfig, err := action.applyConfig[1].ToJSON()
	ExpectWithOffset(1, err).NotTo(HaveOccurred())

	expectedDeleteRegularChainRulesJSONConfig := `
			{"nftables": [
				{"delete": {"chain": {
					"family": "bridge",
					"table": "nat",
					"name": "cni-br-iface-container99-net1"
				}}},
				{"delete": {"chain": {
					"family": "bridge",
					"table": "nat",
					"name": "cni-br-iface-container99-net1-mac"
				}}}
			]}`

	ExpectWithOffset(1, string(deleteRegularChainRulesJSONConfig)).To(MatchJSON(expectedDeleteRegularChainRulesJSONConfig))
}

func assertExpectedBaseChainRuleDeletionInTeardownConfig(action configurerStub) {
	deleteBaseChainRuleJSONConfig, err := action.applyConfig[0].ToJSON()
	Expect(err).NotTo(HaveOccurred())

	expectedDeleteIfaceMatchRuleJSONConfig := `
            {"nftables": [
				{"delete": {"rule": {
					"family": "bridge",
					"table": "nat",
					"chain": "PREROUTING",
					"expr": [
						{"match": {
							"op": "==",
							"left": {"meta": {"key": "iifname"}},
							"right": "net0"
						}},
						{"jump": {"target": "cni-br-iface-container99-net1"}}
					],
					"comment": "macspoofchk-container99-net1"
				}}}
			]}`
	Expect(string(deleteBaseChainRuleJSONConfig)).To(MatchJSON(expectedDeleteIfaceMatchRuleJSONConfig))
}

func rowConfigWithRulesOnly() string {
	return `
            {"nftables":[
                {"rule":{"family":"bridge","table":"nat","chain":"PREROUTING",
                    "expr":[
                        {"match":{"op":"==","left":{"meta":{"key":"iifname"}},"right":"net0"}},
                        {"jump":{"target":"cni-br-iface-container99-net1"}}
                    ],
                    "comment":"macspoofchk-container99-net1"}},
                {"rule":{"family":"bridge","table":"nat","chain":"cni-br-iface-container99-net1",
                    "expr":[
                        {"jump":{"target":"cni-br-iface-container99-net1-mac"}}
                    ],
                    "comment":"macspoofchk-container99-net1"}},
                {"rule":{"family":"bridge","table":"nat","chain":"cni-br-iface-container99-net1-mac",
                    "expr":[
                        {"match":{
                            "op":"==",
                            "left":{"payload":{"protocol":"ether","field":"saddr"}},
                            "right":"02:00:00:00:12:34"
                        }},
                        {"return":null}
                    ],
                    "comment":"macspoofchk-container99-net1"}},
                {"rule":{"family":"bridge","table":"nat","chain":"cni-br-iface-container99-net1-mac",
                    "expr":[{"drop":null}],
                    "index":0,
                    "comment":"macspoofchk-container99-net1"}}
            ]}`
}

func assertExpectedTableAndChainsInSetupConfig(c configurerStub) {
	config := c.applyConfig[0]
	jsonConfig, err := config.ToJSON()
	ExpectWithOffset(1, err).NotTo(HaveOccurred())

	expectedConfig := `
        {"nftables": [
            {"table": {"family": "bridge", "name": "nat"}},
            {"chain": {
                "family": "bridge",
                "table": "nat",
                "name": "PREROUTING",
                "type": "filter",
                "hook": "prerouting",
                "prio": -300,
                "policy": "accept"
            }},
            {"chain": {
                "family": "bridge",
                "table": "nat",
                "name": "cni-br-iface-container99-net1"
            }},
            {"chain": {
                "family": "bridge",
                "table": "nat",
                "name": "cni-br-iface-container99-net1-mac"
            }}
        ]}`
	ExpectWithOffset(1, string(jsonConfig)).To(MatchJSON(expectedConfig))
}

func assertExpectedRulesInSetupConfig(c configurerStub) {
	config := c.applyConfig[1]
	jsonConfig, err := config.ToJSON()
	ExpectWithOffset(1, err).NotTo(HaveOccurred())

	expectedConfig := `
            {"nftables":[
                {"flush":{"chain":{"family":"bridge","table":"nat","name":"cni-br-iface-container99-net1"}}},
                {"flush":{"chain":{"family":"bridge","table":"nat","name":"cni-br-iface-container99-net1-mac"}}},
                {"rule":{"family":"bridge","table":"nat","chain":"PREROUTING",
                    "expr":[
                        {"match":{"op":"==","left":{"meta":{"key":"iifname"}},"right":"net0"}},
                        {"jump":{"target":"cni-br-iface-container99-net1"}}
                    ],
                    "comment":"macspoofchk-container99-net1"}},
                {"rule":{"family":"bridge","table":"nat","chain":"cni-br-iface-container99-net1",
                    "expr":[
                        {"jump":{"target":"cni-br-iface-container99-net1-mac"}}
                    ],
                    "comment":"macspoofchk-container99-net1"}},
                {"rule":{"family":"bridge","table":"nat","chain":"cni-br-iface-container99-net1-mac",
                    "expr":[
                        {"match":{
                            "op":"==",
                            "left":{"payload":{"protocol":"ether","field":"saddr"}},
                            "right":"02:00:00:00:12:34"
                        }},
                        {"return":null}
                    ],
                    "comment":"macspoofchk-container99-net1"}},
                {"rule":{"family":"bridge","table":"nat","chain":"cni-br-iface-container99-net1-mac",
                    "expr":[{"drop":null}],
                    "comment":"macspoofchk-container99-net1"}}
            ]}`
	ExpectWithOffset(1, string(jsonConfig)).To(MatchJSON(expectedConfig))
}

const (
	errorFirstApplyText  = "1st apply failed"
	errorSecondApplyText = "2nd apply failed"
	errorReadText        = "read failed"
)

type configurerStub struct {
	applyConfig []*nft.Config
	readConfig  *nft.Config

	applyCounter int

	failFirstApplyConfig  bool
	failSecondApplyConfig bool
	failReadConfig        bool

	applyReturnNil bool
	readCalled     bool
}

func (a *configurerStub) Apply(c *nft.Config) (*nft.Config, error) {
	a.applyCounter++
	if a.failFirstApplyConfig && a.applyCounter == 1 {
		return nil, errors.New(errorFirstApplyText)
	}
	if a.failSecondApplyConfig && a.applyCounter == 2 {
		return nil, errors.New(errorSecondApplyText)
	}
	a.applyConfig = append(a.applyConfig, c)
	if a.applyReturnNil {
		return nil, nil
	}
	return c, nil
}

func (a *configurerStub) Read(_ ...string) (*nft.Config, error) {
	a.readCalled = true
	if a.failReadConfig {
		return nil, errors.New(errorReadText)
	}
	return a.readConfig, nil
}