// Copyright 2015 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

package seccomp

import (
	"flag"
	"os"
	"runtime"
	"syscall"
	"testing"
	"unsafe"
)

var (
	parseFilePath = flag.String("parse_file", "", "path for TestParseFile")
	testInstall   = flag.Bool("test_install", false, "enable TestInstall (use with -cpu=N)")
	testEndian    = flag.Bool("test_endian", false, "enable TestEndian")
)

func TestParseLine(t *testing.T) {
	tests := []struct {
		policy string
		want   string
		err    string
	}{
		{policy: "read: 1"},
		{policy: "open: return 1"},
		{policy: "prctl: arg0 == 0xf"},
		{policy: "prctl: arg0 != 0xf"},
		{policy: "ioctl: arg1 & 0x5401"},
		{policy: "ioctl: arg1 == 0x4024700a || arg1 == 0x541b"},
		{policy: "ioctl: arg1 == 0x4024700a && arg1 == 0x541b"},
		{policy: "ioctl: arg1 == 0x5401 || arg1 == 0x700a || arg2 & 0x541b"},
		{policy: "ioctl: arg1 == 0x5401 && arg1 == 0x700a && arg3 & 0x541b"},
		{policy: "ioctl: arg1 == 0x5401 || arg1 == 0x700a && arg4 & 0x541b"},
		{policy: "ioctl: arg1 == 0x5401 && arg1 == 0x700a || arg5 & 0x541b"},
		{policy: "ioctl: arg1 == 0x5401 && arg1 == 0x700a || arg5 & 0x541b; return 1"},
		{
			// different spacing around colon.
			policy: "read :1",
			want:   "read: 1",
		},
		{
			// leading and trailing whitespace.
			policy: " open :  return 1  ",
			want:   "open: return 1",
		},
		{
			// return hexadecimal errno.
			policy: "open: return 0x10",
			want:   "open: return 16",
		},
		{
			// return octal errno.
			policy: "open: return 010",
			want:   "open: return 8",
		},
		{
			// return highest errno.
			policy: "open: return 0xffff",
			want:   "open: return 65535",
		},
		{
			// expression with no spaces.
			policy: "ioctl:arg1==0x5401&&arg1==0x700a||arg2&0x541b",
			want:   "ioctl: arg1 == 0x5401 && arg1 == 0x700a || arg2 & 0x541b",
		},
		{
			// compare with decimal value.
			policy: "ioctl: arg1 == 5401 && arg1 == 0x700a || arg2 & 0x541b",
			want:   "ioctl: arg1 == 0x1519 && arg1 == 0x700a || arg2 & 0x541b",
		},
		{
			// compare with octal value.
			policy: "ioctl: arg1 == 05401 && arg1 == 0x700a || arg2 & 0x541b",
			want:   "ioctl: arg1 == 0xb01 && arg1 == 0x700a || arg2 & 0x541b",
		},
		{
			// all decimal comparisons.
			policy: "clone: arg0 == 1 || arg0 == 2 || arg0 == 16",
			want:   "clone: arg0 == 0x1 || arg0 == 0x2 || arg0 == 0x10",
		},
		{
			// missing syscall name.
			policy: ": 1",
			err:    "invalid syntax",
		},
		{
			// malformed syscall name.
			policy: "two words: 1",
			err:    "invalid syntax",
		},
		{
			// missing colon.
			policy: "read = 1",
			err:    "invalid syntax",
		},
		{
			// trailing semicolon after return.
			policy: "open: return 1;",
			err:    "invalid syntax",
		},
		{
			// trailing semicolon after expression.
			policy: "prctl: arg0 == 0xf;",
			err:    "invalid syntax",
		},
		{
			// missing return after semicolon.
			policy: "prctl: arg0 == 0xf; 1",
			err:    "invalid syntax",
		},
		{
			// bad syscall name.
			policy: "bad: 1",
			err:    "unknown syscall: bad",
		},
		{
			// symbolic errno is not supported.
			policy: "open: return EPERM",
			err:    "invalid errno: EPERM",
		},
		{
			// errno must fit in 16 bits.
			policy: "open: return 0x10000",
			err:    "invalid errno: 0x10000",
		},
		{
			// missing argument index.
			policy: "prctl: arg == 0xf",
			err:    "invalid expression: arg == 0xf",
		},
		{
			// arg index out of range.
			policy: "prctl: arg6 == 0xf",
			err:    "invalid expression: arg6 == 0xf",
		},
		{
			// bitwise and with argument not supported.
			policy: "prctl: arg0 & 0xf == 0xf",
			err:    "invalid expression: arg0 & 0xf == 0xf",
		},
		{
			// unknown operator.
			policy: "prctl: arg0 !== 0xf",
			err:    "invalid expression: arg0 !== 0xf",
		},
		{
			// invalid hexadecimal value.
			policy: "prctl: arg0 == 0xfdx",
			err:    "invalid value: arg0 == 0xfdx",
		},
		{
			// invalid decimal value.
			policy: "prctl: arg0 == 123a",
			err:    "invalid value: arg0 == 123a",
		},
		{
			// invalid octal value.
			policy: "prctl: arg0 == 0129",
			err:    "invalid value: arg0 == 0129",
		},
		{
			// invalid subexpression.
			policy: "prctl: arg0 == 0x100 && arg1 = 0x101 || arg2 == 0x102",
			err:    "invalid expression: arg1 = 0x101",
		},
	}
	for _, test := range tests {
		var err string
		p, e := parseLine(test.policy)
		if e != nil {
			err = e.Error()
		}
		if err != "" || test.err != "" {
			if err != test.err {
				t.Errorf("parseLine(%q): error = %q; want %q", test.policy, err, test.err)
			}
			continue
		}
		want := test.want
		if want == "" {
			want = test.policy
		}
		if got := p.String(); got != want {
			t.Errorf("parseLine(%q) = %q; want %q", test.policy, got, test.want)
		}
	}
}

func TestParseLines(t *testing.T) {
	tests := []struct {
		file []string
		err  string
	}{
		{
			// simple policy file.
			file: []string{
				"read: 1",
				"write: 1",
				"open: return 1",
			},
		},
		{
			// comment lines are ignored.
			file: []string{
				"read: 1",
				"write: 1",
				"# open: return EPERM",
				"open: return 1",
			},
		},
		{
			// blank lines are ignored.
			file: []string{
				"read: 1",
				"write: 1",
				"",
				"open: return 1",
			},
		},
		{
			// leading space on comment line.
			file: []string{
				"read: 1",
				"write: 1",
				" # open: return EPERM",
				"open: return 1",
			},
			err: "line 3: invalid syntax",
		},
		{
			// line consisting of whitespace only.
			file: []string{
				"read: 1",
				"write: 1",
				" ",
				"open: return 1",
			},
			err: "line 3: invalid syntax",
		},
		{
			// parse error on one line.
			file: []string{
				"read: 1",
				"write: return 019",
				"open: return 1",
			},
			err: "line 2: invalid errno: 019",
		},
		{
			// multiple policies for a syscall.
			file: []string{
				"read: 1",
				"write: 1",
				"read: return 1",
				"open: return 1",
			},
			err: "lines 1,3: multiple policies for read",
		},
	}
	for _, test := range tests {
		var err string
		_, e := parseLines(test.file)
		if e != nil {
			err = e.Error()
		}
		if err != "" || test.err != "" {
			if err != test.err {
				t.Errorf("parseLines(%q): error = %q; want %q", test.file, err, test.err)
			}
		}
	}
}

func TestParseFile(t *testing.T) {
	if *parseFilePath == "" {
		t.Skip("use -parse_file to enable.")
	}

	if _, err := parseFile(*parseFilePath); err != nil {
		t.Errorf("parseFile(%q): %v", *parseFilePath, err)
	}
}

func TestCompile(t *testing.T) {
	syscallName := make(map[int32]string)
	for name, nr := range syscallNum {
		syscallName[int32(nr)] = name
	}

	call := func(name string, args ...uint64) SeccompData {
		nr, ok := syscallNum[name]
		if !ok {
			t.Fatalf("unknown syscall: %s", name)
		}
		data := SeccompData{
			NR:   int32(nr),
			Arch: auditArch,
		}
		copy(data.Args[:], args)
		return data
	}

	eval := func(bpf []SockFilter, data SeccompData) uint32 {
		var A uint32
		IP := 0
		for {
			Insn := bpf[IP]
			IP++
			switch Insn.Code {
			case opLOAD:
				A = *(*uint32)(unsafe.Pointer(uintptr(unsafe.Pointer(&data)) + uintptr(Insn.K)))
			case opJEQ:
				if A == Insn.K {
					IP += int(Insn.JT)
				} else {
					IP += int(Insn.JF)
				}
			case opJSET:
				if A&Insn.K != 0 {
					IP += int(Insn.JT)
				} else {
					IP += int(Insn.JF)
				}
			case opJUMP:
				IP += int(Insn.K)
			case opRET:
				return Insn.K
			default:
				t.Fatalf("unsupported instruction: %v", Insn)
			}
		}
	}

	file := []string{
		"read: 1",
		"open: return 1",
		"write: arg0 == 1",
		"close: arg0 == 2; return 9",
		"dup: arg0 == 1 || arg0 == 2",
		"pipe: arg0 == 1 && arg1 == 2",
		"link: arg0 != 1 && arg1 != 2 || arg2 == 3",
		"unlink: arg0 != 1 || arg1 != 2 && arg2 == 3",
		"creat: arg0 & 0xf00 && arg1 & 0x0f0 && arg2 & 0x00f",
		"lseek: arg0 & 0x0f000f000f000f00 && arg1 & 0x00f000f000f000f0 && arg2 & 0x000f000f000f000f",
		"stat: arg0 != 0x0123456789abcdef && arg1 != 0x123456789abcdef0 || arg2 == 0x00f000f000000000",
		"fstat: arg0 != 0x0123456789abcdef || arg1 != 0x123456789abcdef0 && arg2 == 0x00f000f000000000",
	}
	tests := []struct {
		data SeccompData
		want uint32
	}{
		{call("fork"), retKill()},
		{call("read"), retAllow()},
		{call("open"), retErrno(1)},
		{call("write", 0), retKill()},
		{call("write", 1), retAllow()},
		{call("close", 1), retErrno(9)},
		{call("close", 2), retAllow()},
		{call("dup", 0), retKill()},
		{call("dup", 1), retAllow()},
		{call("dup", 2), retAllow()},
		{call("dup", 3), retKill()},
		{call("pipe", 1, 1), retKill()},
		{call("pipe", 1, 2), retAllow()},
		{call("pipe", 2, 1), retKill()},
		{call("pipe", 2, 2), retKill()},
		{call("link", 1, 2, 3), retAllow()},
		{call("link", 1, 2, 2), retKill()},
		{call("link", 2, 2, 2), retKill()},
		{call("link", 2, 1, 2), retAllow()},
		{call("unlink", 2, 1, 2), retAllow()},
		{call("unlink", 1, 1, 2), retKill()},
		{call("unlink", 1, 1, 3), retAllow()},
		{call("unlink", 1, 2, 3), retKill()},
		{call("creat", 0x100, 0x100, 0x101), retKill()},
		{call("creat", 0x200, 0x110, 0x101), retAllow()},
		{call("creat", 0x400, 0x110, 0x110), retKill()},
		{call("creat", 0x800, 0x110, 0x007), retAllow()},
		{call("lseek", 0x0100, 0x0100, 0x0101), retKill()},
		{call("lseek", 0x0200, 0x0110, 0x0101), retAllow()},
		{call("lseek", 0x0400, 0x0110, 0x0110), retKill()},
		{call("lseek", 0x0800, 0x0110, 0x0007), retAllow()},
		{call("lseek", 0x0100000000000000, 0x0100000000000000, 0x0101000000000000), retKill()},
		{call("lseek", 0x0200000000000000, 0x0110000000000000, 0x0101000000000000), retAllow()},
		{call("lseek", 0x0400000000000000, 0x0110000000000000, 0x0110000000000000), retKill()},
		{call("lseek", 0x0800000000000000, 0x0110000000000000, 0x0007000000000000), retAllow()},
		{call("stat", 0x0123456789abcdef, 0x123456789abcdef0, 0x00f000f000000000), retAllow()},
		{call("stat", 0x0123456789abcdef, 0x123456789abcdef0, 0x007000f000000000), retKill()},
		{call("stat", 0x0133456789abcdef, 0x123457789abcdef0, 0x007000f000000000), retAllow()},
		{call("stat", 0x0133456789abcdef, 0x123456789abcdef0, 0x007000f000000000), retKill()},
		{call("fstat", 0x0123456789abcdef, 0x123456789abcdef0, 0x00f000f000000000), retKill()},
		{call("fstat", 0x0133456789abcdef, 0x123456789abcdef0, 0x00f000f000000000), retAllow()},
		{call("fstat", 0x0123456789abcdef, 0x123457789abcdef0, 0x00f000f000000000), retAllow()},
		{call("fstat", 0x0123456789abcdef, 0x123457789abcdef0, 0x007000f000000000), retKill()},
	}

	ps, err := parseLines(file)
	if err != nil {
		t.Fatalf("parse failed: %v", err)
	}
	bpf, err := compile(ps, true, bpfRet(retKill()))
	if err != nil {
		t.Fatalf("compile failed: %v", err)
	}
	t.Logf("len(bpf) = %d", len(bpf))
	for _, test := range tests {
		if got := eval(bpf, test.data); got != test.want {
			t.Errorf("%s%#x = %#08x; want %#08x", syscallName[test.data.NR], test.data.Args, got, test.want)
		}
	}
}

func TestSupport(t *testing.T) {
	if err := CheckSupport(); err != nil {
		t.Error(err)
	}
}

func TestInstall(t *testing.T) {
	if !*testInstall {
		t.Skip("use -test_install (with -cpu=N) to enable.")
	}

	file := []string{
		"# open/openat: return EPERM",
		"open: return 1",
		"openat: return 1",
		"# default: ALLOW",
	}

	ps, err := parseLines(file)
	if err != nil {
		t.Fatalf("parse failed: %v", err)
	}
	bpf, err := compile(ps, nbits > 32, bpfRet(retAllow()))
	if err != nil {
		t.Fatalf("compile failed: %v", err)
	}
	if err = Install(bpf); err != nil {
		t.Fatalf("install failed: %v", err)
	}

	N := runtime.GOMAXPROCS(0)
	opened := make(chan bool)
	for i := 0; i < N; i++ {
		go func() {
			if f, err := os.Open("/dev/null"); err != nil {
				t.Logf("open() failed: %v", err)
				opened <- false
			} else {
				t.Logf("open() succeeded")
				f.Close()
				opened <- true
			}
		}()
	}
	for i := 0; i < N; i++ {
		if <-opened {
			t.Fail()
		}
	}
}

func TestEndian(t *testing.T) {
	if !*testEndian {
		t.Skip("use -test_endian to enable.")
	}

	pass := syscall.EDOM
	fail := syscall.ERANGE
	name := map[error]string{
		pass: "pass",
		fail: "fail",
		nil:  "<nil>",
	}

	type seccomp [3]uintptr
	ps := []policy{
		{
			name: "seccomp",
			expr: orExpr{
				andExpr{
					argComp{0, "==", 0x0123456789abcdef},
				},
				andExpr{
					argComp{1, "!=", 0x01234567},
					argComp{2, "&", 0x01010101},
				},
			},
			then: bpfRet(retErrno(pass)),
			def:  ptr(bpfRet(retErrno(fail))),
		},
	}
	tests := []struct {
		args seccomp
		want error
	}{
		{seccomp{0x01234567, 0, 0}, fail},
		{seccomp{0x89abcdef, 0, 0}, pass},
		{seccomp{0, 0x01234567, 0}, fail},
		{seccomp{0, 0x12345678, 0}, fail},
		{seccomp{0, 0x01234567, 1}, fail},
		{seccomp{0, 0x12345678, 1}, pass},
	}
	call := func(args seccomp) error {
		if nr, ok := syscallNum["seccomp"]; ok {
			if _, _, e := syscall.Syscall(uintptr(nr), args[0], args[1], args[2]); e != 0 {
				return e
			}
		}
		return nil
	}

	bpf, err := compile(ps, false, bpfRet(retAllow()))
	if err != nil {
		t.Fatalf("compile failed: %v", err)
	}
	if err = Install(bpf); err != nil {
		t.Fatalf("install failed: %v", err)
	}
	for _, test := range tests {
		if got := call(test.args); got != test.want {
			t.Errorf("seccomp%#x = %v; want %v", test.args, name[got], name[test.want])
		}
	}
}