// Copyright 2013 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package tls

import (
	"bufio"
	"bytes"
	"context"
	"crypto/internal/boring"
	"encoding/hex"
	"errors"
	"flag"
	"fmt"
	"internal/testenv"
	"io"
	"net"
	"os"
	"os/exec"
	"runtime"
	"strconv"
	"strings"
	"sync"
	"testing"
	"testing/cryptotest"
	"time"
)

// TLS reference tests run a connection against a reference implementation
// (OpenSSL) of TLS and record the bytes of the resulting connection. The Go
// code, during a test, is configured with deterministic randomness and so the
// reference test can be reproduced exactly in the future.
//
// In order to save everyone who wishes to run the tests from needing the
// reference implementation installed, the reference connections are saved in
// files in the testdata directory. Thus running the tests involves nothing
// external, but creating and updating them requires the reference
// implementation.
//
// Tests can be updated by running them with the -update flag. This will cause
// the test files for failing tests to be regenerated. Since the reference
// implementation will always generate fresh random numbers, large parts of the
// reference connection will always change.

var (
	update       = flag.Bool("update", false, "update golden files on failure")
	keyFile      = flag.String("keylog", "", "destination file for KeyLogWriter")
	bogoMode     = flag.Bool("bogo-mode", false, "Enabled bogo shim mode, ignore everything else")
	bogoFilter   = flag.String("bogo-filter", "", "BoGo test filter")
	bogoLocalDir = flag.String("bogo-local-dir", "",
		"If not-present, checkout BoGo into this dir, or otherwise use it as a pre-existing checkout")
	bogoReport = flag.String("bogo-html-report", "", "File path to render an HTML report with BoGo results")
)

func runTestAndUpdateIfNeeded(t *testing.T, name string, run func(t *testing.T, update bool)) {
	skipFIPS(t) // FIPS 140-3 mode changes the advertised parameters.

	// Go+BoringCrypto's boring.RandReader ignores the testing override set by
	// cryptotest.SetGlobalRandom, so e.g. ECDH key generation would be
	// non-deterministic. Setting cryptocustomrand=1 makes rand.CustomReader
	// pass the caller's reader (the testing source) through instead.
	if boring.Enabled {
		testenv.SetGODEBUG(t, "cryptocustomrand=1")
	}

	success := t.Run(name, func(t *testing.T) {
		cryptotest.SetGlobalRandom(t, 0)
		run(t, false)
	})

	if !success && *update {
		t.Run(name+"#update", func(t *testing.T) {
			cryptotest.SetGlobalRandom(t, 0)
			run(t, true)
		})
	}
}

// checkOpenSSLVersion ensures that the version of OpenSSL looks reasonable
// before updating the test data.
func checkOpenSSLVersion() error {
	if !*update {
		return nil
	}

	openssl := exec.Command("openssl", "version")
	output, err := openssl.CombinedOutput()
	if err != nil {
		return err
	}

	version := string(output)
	if strings.HasPrefix(version, "OpenSSL 1.1.1") {
		return nil
	}

	println("***********************************************")
	println("")
	println("You need to build OpenSSL 1.1.1 from source in order")
	println("to update the test data.")
	println("")
	println("Configure it with:")
	println("./Configure enable-weak-ssl-ciphers no-shared")
	println("and then add the apps/ directory at the front of your PATH.")
	println("***********************************************")

	return errors.New("version of OpenSSL does not appear to be suitable for updating test data")
}

// recordingConn is a net.Conn that records the traffic that passes through it.
// WriteTo can be used to produce output that can be later be loaded with
// ParseTestData.
type recordingConn struct {
	net.Conn
	sync.Mutex
	flows   [][]byte
	reading bool
}

func (r *recordingConn) Read(b []byte) (n int, err error) {
	if n, err = r.Conn.Read(b); n == 0 {
		return
	}
	b = b[:n]

	r.Lock()
	defer r.Unlock()

	if l := len(r.flows); l == 0 || !r.reading {
		buf := make([]byte, len(b))
		copy(buf, b)
		r.flows = append(r.flows, buf)
	} else {
		r.flows[l-1] = append(r.flows[l-1], b[:n]...)
	}
	r.reading = true
	return
}

func (r *recordingConn) Write(b []byte) (n int, err error) {
	if n, err = r.Conn.Write(b); n == 0 {
		return
	}
	b = b[:n]

	r.Lock()
	defer r.Unlock()

	if l := len(r.flows); l == 0 || r.reading {
		buf := make([]byte, len(b))
		copy(buf, b)
		r.flows = append(r.flows, buf)
	} else {
		r.flows[l-1] = append(r.flows[l-1], b[:n]...)
	}
	r.reading = false
	return
}

// WriteTo writes Go source code to w that contains the recorded traffic.
func (r *recordingConn) WriteTo(w io.Writer) (int64, error) {
	// TLS always starts with a client to server flow.
	clientToServer := true
	var written int64
	for i, flow := range r.flows {
		source, dest := "client", "server"
		if !clientToServer {
			source, dest = dest, source
		}
		n, err := fmt.Fprintf(w, ">>> Flow %d (%s to %s)\n", i+1, source, dest)
		written += int64(n)
		if err != nil {
			return written, err
		}
		dumper := hex.Dumper(w)
		n, err = dumper.Write(flow)
		written += int64(n)
		if err != nil {
			return written, err
		}
		err = dumper.Close()
		if err != nil {
			return written, err
		}
		clientToServer = !clientToServer
	}
	return written, nil
}

func parseTestData(r io.Reader) (flows [][]byte, err error) {
	var currentFlow []byte

	scanner := bufio.NewScanner(r)
	for scanner.Scan() {
		line := scanner.Text()
		// If the line starts with ">>> " then it marks the beginning
		// of a new flow.
		if strings.HasPrefix(line, ">>> ") {
			if len(currentFlow) > 0 || len(flows) > 0 {
				flows = append(flows, currentFlow)
				currentFlow = nil
			}
			continue
		}

		// Otherwise the line is a line of hex dump that looks like:
		// 00000170  fc f5 06 bf (...)  |.....X{&?......!|
		// (Some bytes have been omitted from the middle section.)
		_, after, ok := strings.Cut(line, " ")
		if !ok {
			return nil, errors.New("invalid test data")
		}
		line = after

		before, _, ok := strings.Cut(line, "|")
		if !ok {
			return nil, errors.New("invalid test data")
		}
		line = before

		hexBytes := strings.Fields(line)
		for _, hexByte := range hexBytes {
			val, err := strconv.ParseUint(hexByte, 16, 8)
			if err != nil {
				return nil, errors.New("invalid hex byte in test data: " + err.Error())
			}
			currentFlow = append(currentFlow, byte(val))
		}
	}

	if len(currentFlow) > 0 {
		flows = append(flows, currentFlow)
	}

	return flows, nil
}

// replayingConn is a net.Conn that replays flows recorded by recordingConn.
type replayingConn struct {
	t testing.TB
	sync.Mutex
	flows   [][]byte
	reading bool
}

var _ net.Conn = (*replayingConn)(nil)

func (r *replayingConn) Read(b []byte) (n int, err error) {
	r.Lock()
	defer r.Unlock()

	if !r.reading {
		r.t.Errorf("expected write, got read")
		return 0, fmt.Errorf("recording expected write, got read")
	}

	n = copy(b, r.flows[0])
	r.flows[0] = r.flows[0][n:]
	if len(r.flows[0]) == 0 {
		r.flows = r.flows[1:]
		if len(r.flows) == 0 {
			return n, io.EOF
		} else {
			r.reading = false
		}
	}
	return n, nil
}

func (r *replayingConn) Write(b []byte) (n int, err error) {
	r.Lock()
	defer r.Unlock()

	if r.reading {
		r.t.Errorf("expected read, got write")
		return 0, fmt.Errorf("recording expected read, got write")
	}

	if !bytes.HasPrefix(r.flows[0], b) {
		r.t.Errorf("write mismatch: expected %x, got %x", r.flows[0], b)
		return 0, fmt.Errorf("write mismatch")
	}
	r.flows[0] = r.flows[0][len(b):]
	if len(r.flows[0]) == 0 {
		r.flows = r.flows[1:]
		r.reading = true
	}
	return len(b), nil
}

func (r *replayingConn) Close() error {
	r.Lock()
	defer r.Unlock()

	if len(r.flows) > 0 {
		r.t.Errorf("closed with unfinished flows")
		return fmt.Errorf("unexpected close")
	}
	return nil
}

func (r *replayingConn) LocalAddr() net.Addr                { return nil }
func (r *replayingConn) RemoteAddr() net.Addr               { return nil }
func (r *replayingConn) SetDeadline(t time.Time) error      { return nil }
func (r *replayingConn) SetReadDeadline(t time.Time) error  { return nil }
func (r *replayingConn) SetWriteDeadline(t time.Time) error { return nil }

// tempFile creates a temp file containing contents and returns its path.
func tempFile(contents string) string {
	file, err := os.CreateTemp("", "go-tls-test")
	if err != nil {
		panic("failed to create temp file: " + err.Error())
	}
	path := file.Name()
	file.WriteString(contents)
	file.Close()
	return path
}

// localListener is set up by TestMain and used by localPipe to create Conn
// pairs like net.Pipe, but connected by an actual buffered TCP connection.
var localListener struct {
	mu   sync.Mutex
	addr net.Addr
	ch   chan net.Conn
}

const localFlakes = 0 // change to 1 or 2 to exercise localServer/localPipe handling of mismatches

func localServer(l net.Listener) {
	for n := 0; ; n++ {
		c, err := l.Accept()
		if err != nil {
			return
		}
		if localFlakes == 1 && n%2 == 0 {
			c.Close()
			continue
		}
		localListener.ch <- c
	}
}

var isConnRefused = func(err error) bool { return false }

func localPipe(t testing.TB) (net.Conn, net.Conn) {
	localListener.mu.Lock()
	defer localListener.mu.Unlock()

	addr := localListener.addr

	var err error
Dialing:
	// We expect a rare mismatch, but probably not 5 in a row.
	for i := 0; i < 5; i++ {
		tooSlow := time.NewTimer(1 * time.Second)
		defer tooSlow.Stop()
		var c1 net.Conn
		c1, err = net.Dial(addr.Network(), addr.String())
		if err != nil {
			if runtime.GOOS == "dragonfly" && (isConnRefused(err) || os.IsTimeout(err)) {
				// golang.org/issue/29583: Dragonfly sometimes returns a spurious
				// ECONNREFUSED or ETIMEDOUT.
				<-tooSlow.C
				continue
			}
			t.Fatalf("localPipe: %v", err)
		}
		if localFlakes == 2 && i == 0 {
			c1.Close()
			continue
		}
		for {
			select {
			case <-tooSlow.C:
				t.Logf("localPipe: timeout waiting for %v", c1.LocalAddr())
				c1.Close()
				continue Dialing

			case c2 := <-localListener.ch:
				if c2.RemoteAddr().String() == c1.LocalAddr().String() {
					t.Cleanup(func() { c1.Close() })
					t.Cleanup(func() { c2.Close() })
					return c1, c2
				}
				t.Logf("localPipe: unexpected connection: %v != %v", c2.RemoteAddr(), c1.LocalAddr())
				c2.Close()
			}
		}
	}

	t.Fatalf("localPipe: failed to connect: %v", err)
	panic("unreachable")
}

func TestMain(m *testing.M) {
	flag.Usage = func() {
		fmt.Fprintf(flag.CommandLine.Output(), "Usage of %s:\n", os.Args)
		flag.PrintDefaults()
		if *bogoMode {
			os.Exit(89)
		}
	}

	flag.Parse()

	if *bogoMode {
		bogoShim()
		os.Exit(0)
	}

	os.Exit(runMain(m))
}

func runMain(m *testing.M) int {
	// Cipher suites preferences change based on the architecture. Force them to
	// the version without AES acceleration for test consistency.
	hasAESGCMHardwareSupport = false

	// Set up localPipe.
	l, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		l, err = net.Listen("tcp6", "[::1]:0")
	}
	if err != nil {
		fmt.Fprintf(os.Stderr, "Failed to open local listener: %v", err)
		os.Exit(1)
	}
	localListener.ch = make(chan net.Conn)
	localListener.addr = l.Addr()
	defer l.Close()
	go localServer(l)

	if err := checkOpenSSLVersion(); err != nil {
		fmt.Fprintf(os.Stderr, "Error: %v", err)
		os.Exit(1)
	}

	rootCAPath := tempFile(testRootCertPEM)
	defer os.Remove(rootCAPath)
	defaultClientCommand = []string{"openssl", "s_client", "-no_ticket",
		"-verify", "1", "-verify_return_error", "-CAfile", rootCAPath,
		"-servername", "test.golang.example", "-attime", fmt.Sprint(testTime().Unix())}

	clientRootCAPath := tempFile(testClientRootCertPEM)
	defer os.Remove(clientRootCAPath)
	serverCommand = []string{"openssl", "s_server", "-no_ticket", "-num_tickets", "0",
		"-naccept", "1", "-verify_return_error", "-verifyCAfile", clientRootCAPath,
		"-attime", fmt.Sprint(testTime().Unix())}

	if *keyFile != "" {
		f, err := os.OpenFile(*keyFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
		if err != nil {
			panic("failed to open -keylog file: " + err.Error())
		}
		testConfigClient.KeyLogWriter = f
		testConfigServer.KeyLogWriter = f
		testConfigFIPS140.KeyLogWriter = f
		defer f.Close()
	}

	return m.Run()
}

func testHandshake(t *testing.T, clientConfig, serverConfig *Config) (serverState, clientState ConnectionState, err error) {
	const sentinel = "SENTINEL\n"
	c, s := localPipe(t)
	errChan := make(chan error, 1)
	go func() {
		cli := Client(c, clientConfig)
		err := cli.Handshake()
		if err != nil {
			errChan <- fmt.Errorf("client: %v", err)
			c.Close()
			return
		}
		clientState = cli.ConnectionState()
		buf, err := io.ReadAll(cli)
		if err != nil {
			if serverConfig.ClientAuth != NoClientCert && clientState.Version == VersionTLS13 {
				// In TLS 1.3, client certificates are sent after the server's
				// handshake has completed, and the client only learns about it
				// reading the alert after the handshake.
				errChan <- fmt.Errorf("client (from Read): %v", err)
				c.Close()
				return
			} else {
				t.Errorf("failed to call cli.Read: %v", err)
			}
		}
		defer func() { errChan <- nil }()
		if got := string(buf); got != sentinel {
			t.Errorf("read %q from TLS connection, but expected %q", got, sentinel)
		}
		// We discard the error because after ReadAll returns the server must
		// have already closed the connection. Sending data (the closeNotify
		// alert) can cause a reset, that will make Close return an error.
		cli.Close()
	}()
	server := Server(s, serverConfig)
	err = server.Handshake()
	if err == nil {
		serverState = server.ConnectionState()
		if _, err := io.WriteString(server, sentinel); err != nil {
			t.Errorf("failed to call server.Write: %v", err)
		}
		if err := server.Close(); err != nil {
			t.Errorf("failed to call server.Close: %v", err)
		}
	} else {
		err = fmt.Errorf("server: %v", err)
		s.Close()
	}
	err = errors.Join(err, <-errChan)
	return
}

func fromHex(s string) []byte {
	b, _ := hex.DecodeString(s)
	return b
}

func TestServerHelloTrailingMessage(t *testing.T) {
	// In TLS 1.3 the change cipher spec message is optional. If a CCS message
	// is not sent, after reading the ServerHello, the read traffic secret is
	// set, and all following messages must be encrypted. If the server sends
	// additional unencrypted messages in a record with the ServerHello, the
	// client must either fail or ignore the additional messages.

	c, s := localPipe(t)
	go func() {
		ctx := context.Background()
		srv := Server(s, testConfigServer.Clone())
		clientHello, _, err := srv.readClientHello(ctx)
		if err != nil {
			testFatal(t, err)
		}

		hs := serverHandshakeStateTLS13{
			c:           srv,
			ctx:         ctx,
			clientHello: clientHello,
		}
		if err := hs.processClientHello(); err != nil {
			testFatal(t, err)
		}
		if err := transcriptMsg(hs.clientHello, hs.transcript); err != nil {
			testFatal(t, err)
		}

		record, err := concatHandshakeMessages(hs.hello, &encryptedExtensionsMsg{alpnProtocol: "h2"})
		if err != nil {
			testFatal(t, err)
		}

		if _, err := s.Write(record); err != nil {
			testFatal(t, err)
		}
		srv.Close()
	}()

	cli := Client(c, testConfigClient.Clone())
	expectedErr := "tls: handshake buffer not empty before setting read traffic secret"
	if err := cli.Handshake(); err == nil {
		t.Fatal("expected error from incomplete handshake, got nil")
	} else if err.Error() != expectedErr {
		t.Fatalf("expected error %q, got %q", expectedErr, err.Error())
	}
}

func TestClientHelloTrailingMessage(t *testing.T) {
	// Same as TestServerHelloTrailingMessage but for the client side.

	c, s := localPipe(t)
	go func() {
		cli := Client(c, testConfigClient.Clone())

		hello, _, _, err := cli.makeClientHello()
		if err != nil {
			testFatal(t, err)
		}

		record, err := concatHandshakeMessages(hello, &certificateMsgTLS13{})
		if err != nil {
			testFatal(t, err)
		}

		if _, err := c.Write(record); err != nil {
			testFatal(t, err)
		}
		cli.Close()
	}()

	srv := Server(s, testConfigServer.Clone())
	expectedErr := "tls: handshake buffer not empty before setting read traffic secret"
	if err := srv.Handshake(); err == nil {
		t.Fatal("expected error from incomplete handshake, got nil")
	} else if err.Error() != expectedErr {
		t.Fatalf("expected error %q, got %q", expectedErr, err.Error())
	}
}

func TestDoubleClientHelloHRR(t *testing.T) {
	// If a client sends two ClientHello messages in a single record, and the
	// server sends a HRR after reading the first ClientHello, the server must
	// either fail or ignore the trailing ClientHello.

	c, s := localPipe(t)

	go func() {
		cli := Client(c, testConfigClient.Clone())

		hello, _, _, err := cli.makeClientHello()
		if err != nil {
			testFatal(t, err)
		}
		hello.keyShares = nil

		record, err := concatHandshakeMessages(hello, hello)
		if err != nil {
			testFatal(t, err)
		}

		if _, err := c.Write(record); err != nil {
			testFatal(t, err)
		}
		cli.Close()
	}()

	srv := Server(s, testConfigServer.Clone())
	expectedErr := "tls: handshake buffer not empty before HelloRetryRequest"
	if err := srv.Handshake(); err == nil {
		t.Fatal("expected error from incomplete handshake, got nil")
	} else if err.Error() != expectedErr {
		t.Fatalf("expected error %q, got %q", expectedErr, err.Error())
	}
}

// concatHandshakeMessages marshals and concatenates the given handshake
// messages into a single record.
func concatHandshakeMessages(msgs ...handshakeMessage) ([]byte, error) {
	var marshalled []byte
	for _, msg := range msgs {
		data, err := msg.marshal()
		if err != nil {
			return nil, err
		}
		marshalled = append(marshalled, data...)
	}
	m := len(marshalled)
	outBuf := make([]byte, recordHeaderLen)
	outBuf[0] = byte(recordTypeHandshake)
	vers := VersionTLS12
	outBuf[1] = byte(vers >> 8)
	outBuf[2] = byte(vers)
	outBuf[3] = byte(m >> 8)
	outBuf[4] = byte(m)
	outBuf = append(outBuf, marshalled...)
	return outBuf, nil
}

func TestMultipleKeyUpdate(t *testing.T) {
	for _, requestUpdate := range []bool{true, false} {
		t.Run(fmt.Sprintf("requestUpdate=%t", requestUpdate), func(t *testing.T) {

			c, s := localPipe(t)
			clientConfig := testConfigClient.Clone()
			clientConfig.MinVersion = VersionTLS13
			clientConfig.MaxVersion = VersionTLS13
			serverConfig := testConfigServer.Clone()
			serverConfig.MinVersion = VersionTLS13
			serverConfig.MaxVersion = VersionTLS13
			client := Client(c, clientConfig)
			server := Server(s, serverConfig)

			clientHandshakeDone := make(chan struct{})
			go func() {
				if err := client.Handshake(); err != nil {
				}
				close(clientHandshakeDone)
				io.Copy(io.Discard, server)
			}()

			if err := server.Handshake(); err != nil {
				t.Fatalf("server handshake failed: %v\n", err)
			}
			<-clientHandshakeDone

			c.SetReadDeadline(time.Now().Add(1 * time.Second))
			s.SetReadDeadline(time.Now().Add(1 * time.Second))

			kuMsg, err := (&keyUpdateMsg{updateRequested: requestUpdate}).marshal()
			if err != nil {
				t.Fatalf("failed to marshal key update message: %v", err)
			}

			client.out.Lock()
			if _, err := client.writeRecordLocked(recordTypeHandshake, append(kuMsg, kuMsg...)); err != nil {
				t.Fatalf("failed to write key update messages: %v", err)
			}
			client.out.Unlock()

			_, err = io.Copy(io.Discard, client)
			if err == nil {
				t.Fatal("expected multiple key update messages to cause an error, got nil")
			} else if !strings.HasSuffix(err.Error(), "tls: unexpected message") {
				t.Fatalf("unexpected error: %v", err)
			}
		})
	}
}