//go:build !windows

package main

import (
	"bufio"
	"bytes"
	"context"
	"errors"
	"fmt"
	"io"
	"net"
	"net/http"
	"strings"
	"sync"
	"testing"
	"time"
)

// The bastion's egress lanes carry ONE plain-HTTP request per connection, read
// the way the Host's egress gate reads it, and every refusal says
// why in its body.
//
// MUTATIONS, each red:
//   - handleEgressConn writes head.String() to upstream and splices, as before:
//     TestEgressPlainHTTPCarriesOneRequestPerConnection, ...SendsTheHostItChecked;
//   - oneEgressExchange's watcher forwards instead of closing: ...OneRequest...;
//   - parseEgressAuthority accepts "@" or cuts the authority at "/" only:
//     TestEgressPlainHTTPReadsTheHostAsTheGateDoes;
//   - writeEgressRefusal writes Content-Length: 0: TestEgressRefusalsCarryABody.

// recordingOrigin stands in for a destination that keeps a connection open
// after answering (it ignores Connection: close, as a careless server may),
// and records every byte one connection carried to it.
type recordingOrigin struct {
	ln    net.Listener
	conns chan string
	// silent: never answer, so the lane never holds an unread answer when it
	// closes (a close with unread data is a reset, which can cost the origin
	// bytes it has not read yet).
	silent bool
}

func newSilentOrigin(t *testing.T) *recordingOrigin {
	o := newRecordingOrigin(t)
	o.silent = true
	return o
}

func newRecordingOrigin(t *testing.T) *recordingOrigin {
	t.Helper()
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	o := &recordingOrigin{ln: ln, conns: make(chan string, 16)}
	t.Cleanup(func() { _ = ln.Close() })
	go func() {
		for {
			c, err := ln.Accept()
			if err != nil {
				return
			}
			go o.serve(c)
		}
	}()
	return o
}

func (o *recordingOrigin) serve(c net.Conn) {
	defer c.Close()
	var mu sync.Mutex
	var got bytes.Buffer
	answered := false
	buf := make([]byte, 4096)
	for {
		_ = c.SetReadDeadline(time.Now().Add(800 * time.Millisecond))
		n, err := c.Read(buf)
		mu.Lock()
		got.Write(buf[:n])
		if !o.silent && !answered && bytes.Contains(got.Bytes(), []byte("\r\n\r\n")) {
			answered = true
			_, _ = io.WriteString(c, "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok")
		}
		mu.Unlock()
		if err != nil {
			break
		}
	}
	o.conns <- got.String()
}

// next is everything the origin's next connection carried, once it ended.
func (o *recordingOrigin) next(t *testing.T) string {
	t.Helper()
	s, ok := o.nextWithin(8 * time.Second)
	if !ok {
		t.Fatal("the destination never saw its connection end")
	}
	return s
}

func (o *recordingOrigin) nextWithin(d time.Duration) (string, bool) {
	select {
	case s := <-o.conns:
		return s, true
	case <-time.After(d):
		return "", false
	}
}

func (o *recordingOrigin) addr() string { return o.ln.Addr().String() }

// A keep-alive connection carries one request to the destination, never two:
// neither a request sent after the first answer (a client reusing the
// connection) nor one pipelined behind the first.
func TestEgressPlainHTTPCarriesOneRequestPerConnection(t *testing.T) {
	first := "GET http://198.51.100.30/first HTTP/1.1\r\nHost: 198.51.100.30\r\n\r\n"
	second := "GET http://198.51.100.30/second HTTP/1.1\r\nHost: 198.51.100.30\r\n\r\n"

	t.Run("reused after the answer", func(t *testing.T) {
		o := newRecordingOrigin(t)
		var asked []string
		cli, cleanup := dialHandler(t, redirectDial(o.addr(), &asked))
		defer cleanup()
		_, _ = io.WriteString(cli, first)
		br := bufio.NewReader(cli)
		resp, err := http.ReadResponse(br, nil)
		if err != nil {
			t.Fatalf("the first request got no answer: %v", err)
		}
		body, _ := io.ReadAll(resp.Body)
		if string(body) != "ok" {
			t.Fatalf("the first answer was %q", body)
		}
		_, _ = io.WriteString(cli, second)
		got := o.next(t)
		if strings.Contains(got, "/second") {
			t.Fatalf("a second request on one connection reached the destination unvetted:\n%s", got)
		}
		if !strings.Contains(got, "\r\nConnection: close\r\n") {
			t.Fatalf("the request went out without Connection: close:\n%s", got)
		}
		_ = cli.SetReadDeadline(time.Now().Add(3 * time.Second))
		if rest, _ := io.ReadAll(br); len(rest) != 0 {
			t.Fatalf("the lane answered the second request: %q", rest)
		}
		if len(asked) != 1 {
			t.Fatalf("one connection, one dial: %v", asked)
		}
	})

	t.Run("pipelined", func(t *testing.T) {
		o := newRecordingOrigin(t)
		var asked []string
		cli, cleanup := dialHandler(t, redirectDial(o.addr(), &asked))
		defer cleanup()
		_, _ = io.WriteString(cli, first+second)
		got := o.next(t)
		if !strings.Contains(got, "GET http://198.51.100.30/first HTTP/1.1\r\n") {
			t.Fatalf("the first request did not reach the destination:\n%s", got)
		}
		if strings.Contains(got, "/second") {
			t.Fatalf("a pipelined second request reached the destination unvetted:\n%s", got)
		}
	})
}

// The destination reads the host the lane vetted, in the one Host header; hop
// headers, those Connection names and a proxy credential stay on this hop.
func TestEgressPlainHTTPSendsTheHostItChecked(t *testing.T) {
	o := newRecordingOrigin(t)
	var asked []string
	cli, cleanup := dialHandler(t, redirectDial(o.addr(), &asked))
	defer cleanup()
	_, _ = io.WriteString(cli, "GET http://198.51.100.31/p?q=1 HTTP/1.1\r\n"+
		"Host: inside.example.test\r\nProxy-Authorization: Basic eDp5\r\n"+
		"Connection: keep-alive, X-Hop\r\nX-Hop: 1\r\nX-Keep: 2\r\n\r\n")
	got := o.next(t)
	head, _, _ := strings.Cut(got, "\r\n\r\n")
	want := "GET http://198.51.100.31/p?q=1 HTTP/1.1\r\nHost: 198.51.100.31\r\nX-Keep: 2\r\nConnection: close"
	if head != want {
		t.Fatalf("the destination got\n%q\nwant\n%q", head, want)
	}
	if len(asked) != 1 || asked[0] != "198.51.100.31:80" {
		t.Fatalf("the lane must dial the address it vetted: %v", asked)
	}
}

// stubEgressNames answers names without DNS and records each name exactly as
// the lane asked for it.
func stubEgressNames(t *testing.T, m map[string]string) *[]string {
	t.Helper()
	var mu sync.Mutex
	var asked []string
	old := egressResolve
	t.Cleanup(func() { egressResolve = old })
	egressResolve = func(_ context.Context, host string) ([]net.IPAddr, error) {
		mu.Lock()
		asked = append(asked, host)
		mu.Unlock()
		ip, ok := m[host]
		if !ok {
			return nil, errors.New("no such host")
		}
		return []net.IPAddr{{IP: net.ParseIP(ip)}}, nil
	}
	return &asked
}

// The host is read as the gate reads it: the authority ends at the first "/",
// "?" or "#", is lower-cased and loses one trailing dot; userinfo, an
// unbracketed IPv6 literal, a bad port, https in absolute form, two Host
// headers and an ambiguous body length are refused with 400 and a body, before
// anything is resolved or dialled.
func TestEgressPlainHTTPReadsTheHostAsTheGateDoes(t *testing.T) {
	for _, c := range []struct {
		req, wantName, wantLine string
	}{
		{"GET http://public.example.test?@10.0.0.1/ HTTP/1.1\r\n\r\n", "public.example.test",
			"GET http://public.example.test/?@10.0.0.1/ HTTP/1.1"},
		{"GET http://public.example.test#@10.0.0.1/ HTTP/1.1\r\n\r\n", "public.example.test",
			"GET http://public.example.test/ HTTP/1.1"},
		{"GET http://Public.Example.Test./x HTTP/1.1\r\n\r\n", "public.example.test",
			"GET http://public.example.test/x HTTP/1.1"},
		{"GET /x HTTP/1.1\r\nHost: Public.Example.Test:8080\r\n\r\n", "public.example.test",
			"GET /x HTTP/1.1"},
	} {
		o := newRecordingOrigin(t)
		names := stubEgressNames(t, map[string]string{"public.example.test": "198.51.100.40"})
		var asked []string
		cli, cleanup := dialHandler(t, redirectDial(o.addr(), &asked))
		_, _ = io.WriteString(cli, c.req)
		got, _ := o.nextWithin(4 * time.Second)
		cleanup()
		if len(*names) != 1 || (*names)[0] != c.wantName {
			t.Errorf("%q: the lane resolved %q; want only %q", c.req, *names, c.wantName)
		}
		if line, _, _ := strings.Cut(got, "\r\n"); line != c.wantLine {
			t.Errorf("%q: the destination got the request line %q; want %q", c.req, line, c.wantLine)
		}
	}

	for _, req := range []string{
		"GET http://user:pw@public.example.test/ HTTP/1.1\r\n\r\n",
		"GET http://198.51.100.41:80@public.example.test/ HTTP/1.1\r\n\r\n",
		"GET http://2001:db8::1/ HTTP/1.1\r\n\r\n",
		"GET http://public.example.test:80x/ HTTP/1.1\r\n\r\n",
		"GET https://public.example.test/ HTTP/1.1\r\n\r\n",
		"GET / HTTP/1.1\r\nHost: public.example.test\r\nHost: 198.51.100.41\r\n\r\n",
		"GET / HTTP/1.1\r\n\r\n",
		"POST http://public.example.test/ HTTP/1.1\r\nContent-Length: 3\r\nTransfer-Encoding: chunked\r\n\r\n",
		"POST http://public.example.test/ HTTP/1.1\r\nContent-Length: 3\r\nContent-Length: 4\r\n\r\n",
		"POST http://public.example.test/ HTTP/1.1\r\nTransfer-Encoding: gzip, chunked\r\n\r\n",
		"GET http://public.example.test/ HTTP/1.1\r\n X-Folded: 1\r\n\r\n",
		"CONNECT user@public.example.test:443 HTTP/1.1\r\n\r\n",
		"CONNECT 2001:db8::1:443 HTTP/1.1\r\n\r\n",
		"CONNECT [198.51.100.41]:443 HTTP/1.1\r\n\r\n",
	} {
		names := stubEgressNames(t, map[string]string{"public.example.test": "198.51.100.40"})
		var asked []string
		cli, cleanup := dialHandler(t, redirectDial("127.0.0.1:9", &asked))
		_, _ = io.WriteString(cli, req)
		resp, err := http.ReadResponse(bufio.NewReader(cli), nil)
		if err != nil {
			t.Errorf("%q: no answer: %v", req, err)
			cleanup()
			continue
		}
		body, _ := io.ReadAll(resp.Body)
		cleanup()
		if resp.StatusCode != 400 || len(body) == 0 || int64(len(body)) != resp.ContentLength {
			t.Errorf("%q: answered %d with body %q; want 400 with a body saying why", req, resp.StatusCode, body)
		}
		if len(*names) != 0 || len(asked) != 0 {
			t.Errorf("%q: refused requests resolve and dial nothing; resolved %q, dialled %q", req, *names, asked)
		}
	}
}

// A request body goes out framed as its head says, chunked bodies re-encoded,
// and nothing after it.
func TestEgressPlainHTTPBodyIsFramed(t *testing.T) {
	for _, c := range []struct{ req, wantBody string }{
		{"POST http://198.51.100.42/u HTTP/1.1\r\nHost: 198.51.100.42\r\nContent-Length: 5\r\n\r\nhello" +
			"GET http://198.51.100.42/smuggled HTTP/1.1\r\n\r\n", "hello"},
		{"POST http://198.51.100.42/u HTTP/1.1\r\nHost: 198.51.100.42\r\nTransfer-Encoding: chunked\r\n\r\n" +
			"5;ext=1\r\nhello\r\n0\r\nX-Trailer: 1\r\n\r\nGET /smuggled HTTP/1.1\r\n\r\n", "5\r\nhello\r\n0\r\n\r\n"},
	} {
		o := newSilentOrigin(t)
		var asked []string
		cli, cleanup := dialHandler(t, redirectDial(o.addr(), &asked))
		_, _ = io.WriteString(cli, c.req)
		got := o.next(t)
		cleanup()
		_, body, _ := strings.Cut(got, "\r\n\r\n")
		if body != c.wantBody {
			t.Errorf("the destination got the body %q; want %q", body, c.wantBody)
		}
	}
}

// A refusal says why in its body, not only in a header: a 403 from the vetting
// and a 502 from a dial that found no answer, on both request forms, and the
// coder-run proxy's refusals too.
func TestEgressRefusalsCarryABody(t *testing.T) {
	failDial := func(ctx context.Context, network, addr string) (net.Conn, error) {
		return nil, fmt.Errorf("no route")
	}
	okDial := func(ctx context.Context, network, addr string) (net.Conn, error) {
		return nil, fmt.Errorf("must not dial %s", addr)
	}
	check := func(name string, resp *http.Response, err error, want int) {
		t.Helper()
		if err != nil {
			t.Errorf("%s: no answer: %v", name, err)
			return
		}
		body, _ := io.ReadAll(resp.Body)
		if resp.StatusCode != want || len(body) < 10 || int64(len(body)) != resp.ContentLength {
			t.Errorf("%s: answered %d with body %q (Content-Length %d); want %d with a short body saying why",
				name, resp.StatusCode, body, resp.ContentLength, want)
		}
	}
	for _, c := range []struct {
		name string
		dial egressDialer
		req  string
		want int
	}{
		{"plain HTTP to this machine", okDial, "GET http://127.0.0.1:9/ HTTP/1.1\r\n\r\n", 403},
		{"CONNECT to this machine", okDial, "CONNECT 127.0.0.1:9 HTTP/1.1\r\n\r\n", 403},
		{"plain HTTP, no answer", failDial, "GET http://198.51.100.43/ HTTP/1.1\r\n\r\n", 502},
		{"CONNECT, no answer", failDial, "CONNECT 198.51.100.43:443 HTTP/1.1\r\n\r\n", 502},
	} {
		cli, cleanup := dialHandler(t, c.dial)
		_, _ = io.WriteString(cli, c.req)
		resp, err := http.ReadResponse(bufio.NewReader(cli), nil)
		check(c.name, resp, err, c.want)
		cleanup()
	}

	oldDial := coderDialOut
	t.Cleanup(func() { coderDialOut = oldDial })
	coderDialOut = failDial
	for _, c := range []struct {
		name, req string
		want      int
	}{
		{"coder run to a private address", "GET http://10.0.0.1/ HTTP/1.1\r\nHost: 10.0.0.1\r\n\r\n", 403},
		{"coder run, no answer", "GET http://93.184.216.34/ HTTP/1.1\r\nHost: 93.184.216.34\r\n\r\n", 502},
	} {
		boxEnd, runEnd := net.Pipe()
		var refused int64
		go handleCoderEgressConn(boxEnd, nil, &refused)
		_ = runEnd.SetDeadline(time.Now().Add(5 * time.Second))
		_, _ = io.WriteString(runEnd, c.req)
		resp, err := http.ReadResponse(bufio.NewReader(runEnd), nil)
		check(c.name, resp, err, c.want)
		_ = runEnd.Close()
	}
}

// The coder-run proxy carries one request per connection too: the run's own
// processes are the sender there.
func TestCoderEgressCarriesOneRequestPerConnection(t *testing.T) {
	o := newRecordingOrigin(t)
	oldDial := coderDialOut
	t.Cleanup(func() { coderDialOut = oldDial })
	coderDialOut = func(ctx context.Context, network, addr string) (net.Conn, error) {
		return (&net.Dialer{}).DialContext(ctx, network, o.addr())
	}
	boxEnd, runEnd := net.Pipe()
	var refused int64
	go handleCoderEgressConn(boxEnd, nil, &refused)
	_ = runEnd.SetDeadline(time.Now().Add(8 * time.Second))
	_, _ = io.WriteString(runEnd, "GET http://93.184.216.34/first HTTP/1.1\r\nHost: 93.184.216.34\r\n\r\n")
	br := bufio.NewReader(runEnd)
	resp, err := http.ReadResponse(br, nil)
	if err != nil {
		t.Fatalf("the first request got no answer: %v", err)
	}
	_, _ = io.ReadAll(resp.Body)
	_, _ = io.WriteString(runEnd, "GET http://93.184.216.34/second HTTP/1.1\r\nHost: inside.example.test\r\n\r\n")
	got := o.next(t)
	_ = runEnd.Close()
	if strings.Contains(got, "/second") || strings.Contains(got, "inside.example.test") {
		t.Fatalf("a second request on one connection reached the destination unvetted:\n%s", got)
	}
	if !strings.Contains(got, "\r\nConnection: close\r\n") {
		t.Fatalf("the request went out without Connection: close:\n%s", got)
	}
}