quorate/services/oci-l4-relay-guest/cmd/smtp-deny/main_test.go

package main

import (
	"bytes"
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

func policy() activationConfig {
	return activationConfig{
		publicInterface:          "ens3",
		minimumObservations:      20,
		maximumAddresses:         4096,
		maximumIntervals:         1024,
		maximumLifetime:          24 * time.Hour,
		maximumObservationWindow: 10 * time.Minute,
	}
}

func validBundle(now time.Time) bundle {
	return bundle{
		SchemaVersion: 1,
		GeneratedAt:   now,
		ExpiresAt:     now.Add(24 * time.Hour),
		DeniedIPv4: []denyEntry{{
			Start:              "192.0.2.1",
			End:                "192.0.2.1",
			Reason:             "connection-rate",
			ObservationStarted: now.Add(-10 * time.Minute),
			ObservationEnded:   now,
			ObservationCount:   20,
			ExpiresAt:          now.Add(24 * time.Hour),
		}},
		DeniedIntervalCount: 1,
		DeniedAddressCount:  1,
	}
}

func TestWriteAndReadEmptyBundle(t *testing.T) {
	now := time.Now().UTC().Truncate(time.Second)
	path := filepath.Join(t.TempDir(), "empty", "current.json.gz")
	document := bundle{
		SchemaVersion: 1,
		GeneratedAt:   now,
		ExpiresAt:     now.Add(24 * time.Hour),
		DeniedIPv4:    []denyEntry{},
	}
	if err := writeBundle(path, document); err != nil {
		t.Fatal(err)
	}
	validated, err := readBundle(now, policy(), path)
	if err != nil {
		t.Fatal(err)
	}
	if validated.DeniedIntervalCount != 0 || validated.DeniedAddressCount != 0 || validated.DeniedIPv4 == nil {
		t.Fatal("empty bundle did not retain an explicit empty deny list")
	}
}

func TestRemovedIntervalCount(t *testing.T) {
	now := time.Date(2026, 7, 26, 0, 0, 0, 0, time.UTC)
	previous, err := validateBundle(now, policy(), validBundle(now))
	if err != nil {
		t.Fatal(err)
	}
	currentDocument := validBundle(now)
	currentDocument.DeniedIPv4 = []denyEntry{}
	currentDocument.DeniedIntervalCount = 0
	currentDocument.DeniedAddressCount = 0
	current, err := validateBundle(now, policy(), currentDocument)
	if err != nil {
		t.Fatal(err)
	}
	if removedIntervalCount(previous, current) != 1 {
		t.Fatal("omitted range was not recorded as removed")
	}
}

func TestWriteJSONFileCreatesParentDirectory(t *testing.T) {
	path := filepath.Join(t.TempDir(), "audit", "summary.json")
	if err := writeJSONFile(path, map[string]int{"removed_interval_count": 1}); err != nil {
		t.Fatal(err)
	}
	contents, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if string(contents) != "{\"removed_interval_count\":1}\n" {
		t.Fatalf("unexpected summary %q", contents)
	}
}

func TestWriteActivePolicyStatePreservesRemoteCurrentActivation(t *testing.T) {
	now := time.Date(2026, 7, 29, 0, 0, 0, 0, time.UTC)
	directory := t.TempDir()
	validated, err := validateBundle(now, policy(), validBundle(now))
	if err != nil {
		t.Fatal(err)
	}
	if err := writeActivePolicyState(directory, now, "current", &validated); err != nil {
		t.Fatal(err)
	}
	cacheActivation := now.Add(time.Minute)
	if err := writeActivePolicyState(directory, cacheActivation, "cache", &validated); err != nil {
		t.Fatal(err)
	}
	state, err := readActivePolicyState(filepath.Join(directory, activePolicyStateFile))
	if err != nil {
		t.Fatal(err)
	}
	if state.Source != "cache" || !state.ActivatedAt.Equal(cacheActivation) || !state.LastRemoteCurrentAt.Equal(now) {
		t.Fatalf("unexpected active state %#v", state)
	}
	if !state.BundleGeneratedAt.Equal(validated.GeneratedAt) || !state.BundleExpiresAt.Equal(validated.ExpiresAt) {
		t.Fatalf("unexpected bundle state %#v", state)
	}
}

func TestWriteActivePolicyStateRecordsFailOpen(t *testing.T) {
	now := time.Date(2026, 7, 29, 0, 0, 0, 0, time.UTC)
	directory := t.TempDir()
	if err := writeActivePolicyState(directory, now, "fail-open", nil); err != nil {
		t.Fatal(err)
	}
	state, err := readActivePolicyState(filepath.Join(directory, activePolicyStateFile))
	if err != nil {
		t.Fatal(err)
	}
	if state.Source != "fail-open" || !state.BundleGeneratedAt.IsZero() || !state.BundleExpiresAt.IsZero() {
		t.Fatalf("unexpected fail-open state %#v", state)
	}
}

func TestFailOpenRecordsFinalStateAfterRulesLoad(t *testing.T) {
	now := time.Date(2026, 7, 29, 0, 0, 0, 0, time.UTC)
	directory := t.TempDir()
	observedPath := filepath.Join(directory, "observed-state.json")
	nftPath := filepath.Join(directory, "nft")
	script := "#!/bin/sh\nif [ \"$1\" = \"--file\" ]; then cp \"$STATE_PATH\" \"$OBSERVED_PATH\"; exit \"${NFT_LOAD_EXIT:-0}\"; fi\nexit 0\n"
	if err := os.WriteFile(nftPath, []byte(script), 0700); err != nil {
		t.Fatal(err)
	}
	t.Setenv("STATE_PATH", filepath.Join(directory, activePolicyStateFile))
	t.Setenv("OBSERVED_PATH", observedPath)
	configuration := policy()
	configuration.stateDirectory = directory
	configuration.nft = nftPath

	if err := failOpen(now, configuration); err != nil {
		t.Fatal(err)
	}
	observed, err := readActivePolicyState(observedPath)
	if err != nil {
		t.Fatal(err)
	}
	if observed.Source != "transition" {
		t.Fatalf("rules loaded after source %q was reported", observed.Source)
	}
	final, err := readActivePolicyState(filepath.Join(directory, activePolicyStateFile))
	if err != nil {
		t.Fatal(err)
	}
	if final.Source != "fail-open" {
		t.Fatalf("unexpected final source %q", final.Source)
	}
}

func TestActivationRecordsFinalStateAfterRulesLoad(t *testing.T) {
	now := time.Date(2026, 7, 29, 0, 0, 0, 0, time.UTC)
	directory := t.TempDir()
	bundlePath := filepath.Join(directory, "current.json.gz")
	if err := writeBundle(bundlePath, validBundle(now)); err != nil {
		t.Fatal(err)
	}
	observedPath := filepath.Join(directory, "observed-state.json")
	nftPath := filepath.Join(directory, "nft")
	script := "#!/bin/sh\nif [ \"$1\" = \"--file\" ]; then cp \"$STATE_PATH\" \"$OBSERVED_PATH\"; fi\nexit 0\n"
	if err := os.WriteFile(nftPath, []byte(script), 0700); err != nil {
		t.Fatal(err)
	}
	t.Setenv("STATE_PATH", filepath.Join(directory, activePolicyStateFile))
	t.Setenv("OBSERVED_PATH", observedPath)
	configuration := policy()
	configuration.stateDirectory = directory
	configuration.nft = nftPath

	if err := activate(now, configuration, bundlePath, true, "current"); err != nil {
		t.Fatal(err)
	}
	observed, err := readActivePolicyState(observedPath)
	if err != nil {
		t.Fatal(err)
	}
	if observed.Source != "transition" {
		t.Fatalf("rules loaded after source %q was reported", observed.Source)
	}
	final, err := readActivePolicyState(filepath.Join(directory, activePolicyStateFile))
	if err != nil {
		t.Fatal(err)
	}
	if final.Source != "current" {
		t.Fatalf("unexpected final source %q", final.Source)
	}
}

func TestFailOpenLoadFailureRemainsTransitional(t *testing.T) {
	now := time.Date(2026, 7, 29, 0, 0, 0, 0, time.UTC)
	directory := t.TempDir()
	nftPath := filepath.Join(directory, "nft")
	script := "#!/bin/sh\nif [ \"$1\" = \"--file\" ]; then exit 1; fi\nexit 0\n"
	if err := os.WriteFile(nftPath, []byte(script), 0700); err != nil {
		t.Fatal(err)
	}
	configuration := policy()
	configuration.stateDirectory = directory
	configuration.nft = nftPath

	if err := failOpen(now, configuration); err == nil {
		t.Fatal("expected nftables load failure")
	}
	state, err := readActivePolicyState(filepath.Join(directory, activePolicyStateFile))
	if err != nil {
		t.Fatal(err)
	}
	if state.Source != "transition" {
		t.Fatalf("failed rules load reported source %q", state.Source)
	}
}

func TestValidateAndRender(t *testing.T) {
	now := time.Date(2026, 7, 26, 0, 0, 0, 0, time.UTC)
	validated, err := validateBundle(now, policy(), validBundle(now))
	if err != nil {
		t.Fatal(err)
	}
	var output bytes.Buffer
	if err := render(&output, now, validated, "ens3"); err != nil {
		t.Fatal(err)
	}
	for _, expected := range []string{
		"table inet oci_l4_relay_smtp_deny",
		"flags interval, timeout",
		"192.0.2.1 timeout 86400s",
		`iifname "ens3" tcp dport 25`,
		"counter name smtp_denied drop",
	} {
		if !strings.Contains(output.String(), expected) {
			t.Errorf("rendered ruleset does not contain %q", expected)
		}
	}
	for _, excluded := range []string{"dport 465", "dport 587", "dport 993", "dport { 80, 443 }"} {
		if strings.Contains(output.String(), excluded) {
			t.Errorf("rendered SMTP deny ruleset contains %q", excluded)
		}
	}
}

func TestEmptyBundleIsValidAndFailOpenIsEmpty(t *testing.T) {
	now := time.Date(2026, 7, 26, 0, 0, 0, 0, time.UTC)
	document := validBundle(now)
	document.DeniedIPv4 = nil
	document.DeniedIntervalCount = 0
	document.DeniedAddressCount = 0
	validated, err := validateBundle(now, policy(), document)
	if err != nil {
		t.Fatal(err)
	}
	var rendered bytes.Buffer
	if err := render(&rendered, now, validated, "ens3"); err != nil {
		t.Fatal(err)
	}
	var failOpen bytes.Buffer
	if err := renderFailOpen(&failOpen, "ens3"); err != nil {
		t.Fatal(err)
	}
	for name, value := range map[string]string{"empty bundle": rendered.String(), "fail open": failOpen.String()} {
		if strings.Contains(value, "elements =") {
			t.Errorf("%s unexpectedly contains deny elements", name)
		}
		if !strings.Contains(value, "ip saddr @denied_v4") {
			t.Errorf("%s does not retain the empty deny lookup", name)
		}
	}
}

func TestExpiredEntryDecaysWithoutInvalidatingBundle(t *testing.T) {
	now := time.Date(2026, 7, 26, 0, 0, 0, 0, time.UTC)
	document := validBundle(now)
	document.DeniedIPv4[0].ObservationEnded = now.Add(-2 * time.Minute)
	document.DeniedIPv4[0].ExpiresAt = now.Add(-time.Minute)
	validated, err := validateBundle(now, policy(), document)
	if err != nil {
		t.Fatal(err)
	}
	var output bytes.Buffer
	if err := render(&output, now, validated, "ens3"); err != nil {
		t.Fatal(err)
	}
	if strings.Contains(output.String(), "192.0.2.1") {
		t.Fatal("expired entry remained in the rendered deny set")
	}
}

func TestPolicyBoundaries(t *testing.T) {
	now := time.Date(2026, 7, 26, 0, 0, 0, 0, time.UTC)
	maximum := validBundle(now)
	maximum.DeniedIPv4[0].Start = "192.0.2.0"
	maximum.DeniedIPv4[0].End = "192.0.17.255"
	maximum.DeniedAddressCount = 4096
	if _, err := validateBundle(now, policy(), maximum); err != nil {
		t.Fatal(err)
	}
	tests := map[string]func(*bundle){
		"observation threshold": func(value *bundle) {
			value.DeniedIPv4[0].ObservationCount = 19
		},
		"address cap": func(value *bundle) {
			value.DeniedIPv4[0].Start = "192.0.2.0"
			value.DeniedIPv4[0].End = "192.0.18.0"
			value.DeniedAddressCount = 4097
		},
		"lifetime": func(value *bundle) {
			value.ExpiresAt = now.Add(24*time.Hour + time.Second)
			value.DeniedIPv4[0].ExpiresAt = value.ExpiresAt
		},
		"observation window": func(value *bundle) {
			value.DeniedIPv4[0].ObservationStarted = now.Add(-10*time.Minute - time.Second)
		},
	}
	for name, mutate := range tests {
		t.Run(name, func(t *testing.T) {
			value := validBundle(now)
			mutate(&value)
			if _, err := validateBundle(now, policy(), value); err == nil {
				t.Fatal("expected policy-bound failure")
			}
		})
	}
	intervals := validBundle(now)
	intervals.DeniedIPv4 = make([]denyEntry, 1025)
	for index := range intervals.DeniedIPv4 {
		entry := validBundle(now).DeniedIPv4[0]
		entry.Start = ipv4String(uint32(index * 2))
		entry.End = entry.Start
		intervals.DeniedIPv4[index] = entry
	}
	intervals.DeniedIntervalCount = len(intervals.DeniedIPv4)
	intervals.DeniedAddressCount = uint64(len(intervals.DeniedIPv4))
	if _, err := validateBundle(now, policy(), intervals); err == nil {
		t.Fatal("expected interval-cap failure")
	}
}

func TestValidationRejectsNonTransportOrMalformedEvidence(t *testing.T) {
	now := time.Date(2026, 7, 26, 0, 0, 0, 0, time.UTC)
	tests := map[string]func(*bundle){
		"schema":  func(value *bundle) { value.SchemaVersion = 2 },
		"expired": func(value *bundle) { value.ExpiresAt = now },
		"ipv6":    func(value *bundle) { value.DeniedIPv4[0].Start = "2001:db8::1" },
		"reason":  func(value *bundle) { value.DeniedIPv4[0].Reason = "spam-score" },
		"future window": func(value *bundle) {
			value.DeniedIPv4[0].ObservationEnded = now.Add(6 * time.Minute)
		},
	}
	for name, mutate := range tests {
		t.Run(name, func(t *testing.T) {
			value := validBundle(now)
			mutate(&value)
			if _, err := validateBundle(now, policy(), value); err == nil {
				t.Fatal("expected validation failure")
			}
		})
	}
}

func TestReadBundleRejectsContentEvidence(t *testing.T) {
	now := time.Now().UTC().Truncate(time.Second)
	contents, err := json.Marshal(validBundle(now))
	if err != nil {
		t.Fatal(err)
	}
	contents = bytes.Replace(contents, []byte(`"reason":"connection-rate"`), []byte(`"reason":"connection-rate","spam_score":9`), 1)
	path := filepath.Join(t.TempDir(), "bundle.json")
	if err := os.WriteFile(path, contents, 0600); err != nil {
		t.Fatal(err)
	}
	if _, err := readBundle(now, policy(), path); err == nil {
		t.Fatal("expected content evidence to be rejected")
	}
}

func TestRejectsUnsafeInterface(t *testing.T) {
	if err := renderFailOpen(&bytes.Buffer{}, "ens3\nflush ruleset"); err == nil {
		t.Fatal("expected unsafe interface rejection")
	}
}