package suricata

import (
	"fmt"
	"log"
	"math/rand"
	"net"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/stretchr/testify/require"

	"github.com/influxdata/telegraf"
	"github.com/influxdata/telegraf/testutil"
)

var ex2 = `{"timestamp":"2017-03-06T07:43:39.000397+0000","event_type":"stats","stats":` +
	`{"capture":{"kernel_packets":905344474,"kernel_drops":78355440,"kernel_packets_delta":2376742,"kernel_drops_delta":82049}}}`
var ex3 = `{"timestamp":"2017-03-06T07:43:39.000397+0000","event_type":"stats","stats":` +
	`{"threads": { "W#05-wlp4s0": { "capture":{"kernel_packets":905344474,"kernel_drops":78355440}}}}}`

func TestSuricataLarge(t *testing.T) {
	dir := t.TempDir()
	tmpfn := filepath.Join(dir, fmt.Sprintf("t%d", rand.Int63()))

	s := Suricata{
		Source:    tmpfn,
		Delimiter: ".",
		Alerts:    true,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}
	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	data, err := os.ReadFile("testdata/test1.json")
	require.NoError(t, err)

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write(data)
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)

	// test suricata alerts
	data2, err := os.ReadFile("testdata/test2.json")
	require.NoError(t, err)
	_, err = c.Write(data2)
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.Wait(1)
}

func TestSuricataAlerts(t *testing.T) {
	dir := t.TempDir()
	tmpfn := filepath.Join(dir, fmt.Sprintf("t%d", rand.Int63()))

	s := Suricata{
		Source:    tmpfn,
		Delimiter: ".",
		Alerts:    true,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}
	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	data, err := os.ReadFile("testdata/test3.json")
	require.NoError(t, err)

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write(data)
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.Wait(1)

	expected := []telegraf.Metric{
		testutil.MustMetric(
			"suricata_alert",
			map[string]string{},
			map[string]interface{}{
				"action":       "allowed",
				"category":     "Misc activity",
				"gid":          float64(1),
				"rev":          float64(0),
				"signature":    "Corrupted HTTP body",
				"signature_id": float64(6),
				"severity":     float64(3),
				"source.ip":    "10.0.0.5",
				"target.ip":    "179.60.192.3",
				"source.port":  float64(18715),
				"target.port":  float64(80),
			},
			time.Unix(0, 0),
		),
	}

	testutil.RequireMetricsEqual(t, expected, acc.GetTelegrafMetrics(), testutil.IgnoreTime())
}

func TestSuricata(t *testing.T) {
	dir := t.TempDir()
	tmpfn := filepath.Join(dir, fmt.Sprintf("t%d", rand.Int63()))

	s := Suricata{
		Source:    tmpfn,
		Delimiter: ".",
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}
	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write([]byte(ex2))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.Wait(1)

	expected := []telegraf.Metric{
		testutil.MustMetric(
			"suricata",
			map[string]string{
				"thread": "total",
			},
			map[string]interface{}{
				"capture.kernel_packets":       float64(905344474),
				"capture.kernel_drops":         float64(78355440),
				"capture.kernel_packets_delta": float64(2376742),
				"capture.kernel_drops_delta":   float64(82049),
			},
			time.Unix(0, 0),
		),
	}

	testutil.RequireMetricsEqual(t, expected, acc.GetTelegrafMetrics(), testutil.IgnoreTime())
}

func TestThreadStats(t *testing.T) {
	dir := t.TempDir()
	tmpfn := filepath.Join(dir, fmt.Sprintf("t%d", rand.Int63()))

	s := Suricata{
		Source:    tmpfn,
		Delimiter: ".",
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}

	acc := testutil.Accumulator{}
	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write([]byte(""))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	_, err = c.Write([]byte("foobard}\n"))
	require.NoError(t, err)
	_, err = c.Write([]byte(ex3))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())
	acc.Wait(2)

	expected := []telegraf.Metric{
		testutil.MustMetric(
			"suricata",
			map[string]string{
				"thread": "W#05-wlp4s0",
			},
			map[string]interface{}{
				"capture.kernel_packets": float64(905344474),
				"capture.kernel_drops":   float64(78355440),
			},
			time.Unix(0, 0),
		),
	}

	testutil.RequireMetricsEqual(t, expected, acc.GetTelegrafMetrics(), testutil.IgnoreTime())
}

func TestSuricataInvalid(t *testing.T) {
	dir := t.TempDir()
	tmpfn := filepath.Join(dir, fmt.Sprintf("t%d", rand.Int63()))

	s := Suricata{
		Source: tmpfn,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}
	acc.SetDebug(true)

	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write([]byte("sfjiowef"))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.WaitError(1)
}

func TestSuricataInvalidPath(t *testing.T) {
	tmpfn := fmt.Sprintf("/t%d/X", rand.Int63())
	s := Suricata{
		Source: tmpfn,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}

	acc := testutil.Accumulator{}
	require.Error(t, s.Start(&acc))
}

func TestSuricataTooLongLine(t *testing.T) {
	tmpfn := testutil.TempSocket(t)

	s := Suricata{
		Source: tmpfn,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}

	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write([]byte(strings.Repeat("X", 20000000)))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.WaitError(1)
}

func TestSuricataEmptyJSON(t *testing.T) {
	tmpfn := testutil.TempSocket(t)

	s := Suricata{
		Source: tmpfn,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}
	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	c, err := net.Dial("unix", tmpfn)
	if err != nil {
		log.Println(err)
	}
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.WaitError(1)
}

func TestSuricataDisconnectSocket(t *testing.T) {
	tmpfn := testutil.TempSocket(t)

	s := Suricata{
		Source: tmpfn,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}

	require.NoError(t, s.Start(&acc))
	defer s.Stop()

	c, err := net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write([]byte(ex2))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	c, err = net.Dial("unix", tmpfn)
	require.NoError(t, err)
	_, err = c.Write([]byte(ex3))
	require.NoError(t, err)
	_, err = c.Write([]byte("\n"))
	require.NoError(t, err)
	require.NoError(t, c.Close())

	acc.Wait(2)
}

func TestSuricataStartStop(t *testing.T) {
	tmpfn := testutil.TempSocket(t)

	s := Suricata{
		Source: tmpfn,
		Log: testutil.Logger{
			Name: "inputs.suricata",
		},
	}
	acc := testutil.Accumulator{}
	require.NoError(t, s.Start(&acc))
	s.Stop()
}

func TestSuricataParse(t *testing.T) {
	tests := []struct {
		filename string
		expected []telegraf.Metric
	}{{
		filename: "test2.json",
		expected: []telegraf.Metric{
			testutil.MustMetric(
				"suricata",
				map[string]string{
					"thread": "W#01-ens2f1",
				},
				map[string]interface{}{
					"detect_alert":                float64(0),
					"detect_engines_id":           float64(0),
					"detect_engines_last_reload":  "2021-06-08T06:33:05.084872+0000",
					"detect_engines_rules_failed": float64(0),
					"detect_engines_rules_loaded": float64(22712),
				},
				time.Unix(0, 0),
			),
		},
	},
	}

	for _, tc := range tests {
		data, err := os.ReadFile("testdata/" + tc.filename)
		require.NoError(t, err)

		s := Suricata{
			Delimiter: "_",
		}
		acc := testutil.Accumulator{}
		err = s.parse(&acc, data)
		require.NoError(t, err)

		testutil.RequireMetricsEqual(t, tc.expected, acc.GetTelegrafMetrics(), testutil.IgnoreTime())
	}
}

func TestSuricataParseVersion2(t *testing.T) {
	tests := []struct {
		filename string
		expected []telegraf.Metric
	}{
		{
			filename: "v2/alert.json",
			expected: []telegraf.Metric{
				testutil.MustMetric(
					"suricata",
					map[string]string{
						"event_type": "alert",
						"in_iface":   "s1-suricata",
						"proto":      "TCP",
					},
					map[string]interface{}{
						"action":       "allowed",
						"category":     "Misc activity",
						"dest_ip":      "179.60.192.3",
						"dest_port":    int64(80),
						"gid":          float64(1),
						"rev":          float64(0),
						"severity":     float64(3),
						"signature":    "Corrupted HTTP body",
						"signature_id": float64(6),
						"sourceip":     "10.0.0.5",
						"sourceport":   float64(18715),
						"src_ip":       "10.0.0.5",
						"src_port":     int64(18715),
						"targetip":     "179.60.192.3",
						"targetport":   float64(80),
					},
					time.Unix(0, 0),
				),
			},
		},
		{
			filename: "v2/dns.json",
			expected: []telegraf.Metric{
				testutil.MustMetric(
					"suricata",
					map[string]string{
						"event_type": "dns",
						"in_iface":   "eth1",
						"proto":      "UDP",
					},
					map[string]interface{}{
						"dest_ip":   "192.168.0.1",
						"dest_port": int64(53),
						"id":        float64(7145),
						"rrname":    "reddit.com",
						"rrtype":    "A",
						"src_ip":    "192.168.0.100",
						"type":      "query",
						"src_port":  int64(39262),
						"tx_id":     float64(10),
					},
					time.Unix(0, 0),
				),
			},
		},
		{
			filename: "v2/drop.json",
			expected: []telegraf.Metric{
				testutil.MustMetric(
					"suricata",
					map[string]string{
						"event_type": "drop",
						"in_iface":   "eth1",
						"proto":      "TCP",
					},
					map[string]interface{}{
						"dest_ip":   "54.192.18.125",
						"dest_port": int64(443),
						"ipid":      float64(62316),
						"len":       float64(76),
						"reason":    "stream error",
						"src_ip":    "192.168.0.110",
						"src_port":  int64(46016),
						"tcpack":    float64(2339873683),
						"tcpres":    float64(0),
						"tcpseq":    float64(3900248957),
						"tcpurgp":   float64(0),
						"tcpwin":    float64(501),
						"tos":       float64(0),
						"ttl":       float64(64),
					},
					time.Unix(0, 0),
				),
			},
		},
		{
			filename: "v2/flow.json",
			expected: []telegraf.Metric{
				testutil.MustMetric(
					"suricata",
					map[string]string{
						"event_type": "flow",
						"in_iface":   "eth1",
						"proto":      "TCP",
					},
					map[string]interface{}{
						"age":       float64(0),
						"dest_ip":   "142.251.130.3",
						"dest_port": int64(443),
						"src_ip":    "192.168.0.121",
						"src_port":  int64(50212),
						"state":     "new",
					},
					time.Unix(0, 0),
				),
			},
		},
		{
			filename: "v2/http.json",
			expected: []telegraf.Metric{
				testutil.MustMetric(
					"suricata",
					map[string]string{
						"event_type": "http",
						"in_iface":   "eth2",
						"proto":      "TCP",
					},
					map[string]interface{}{
						"dest_ip":           "203.205.239.179",
						"dest_port":         int64(80),
						"hostname":          "hkminorshort.weixin.qq.com",
						"http_content_type": "application/octet-stream",
						"http_method":       "POST",
						"http_user_agent":   "MicroMessenger Client",
						"length":            float64(245),
						"protocol":          "HTTP/1.1",
						"src_ip":            "192.168.0.120",
						"src_port":          int64(33950),
						"status":            float64(200),
						"url":               "/mmtls/2d6d45f1",
					},
					time.Unix(0, 0),
				),
			},
		},
		{
			filename: "v2/status.json",
			expected: []telegraf.Metric{
				testutil.MustMetric(
					"suricata",
					map[string]string{
						"event_type": "stats",
					},
					map[string]interface{}{
						"captureerrors":          float64(0),
						"capturekernel_drops":    float64(0),
						"capturekernel_packets":  float64(522),
						"flowemerg_mode_entered": float64(0),
						"flowemerg_mode_over":    float64(0),
						"flowmemcap":             float64(0),
						"flowmemuse":             float64(9965056),
						"flowmgrclosed_pruned":   float64(0),
						"flowmgrfull_hash_pass":  float64(1),
						"flowmgrnew_pruned":      float64(0),
						"flowspare":              float64(10100),
						"flowtcp":                float64(15),
						"flowudp":                float64(13),
						"flowwrkspare_sync":      float64(11),
						"flowwrkspare_sync_avg":  float64(100),
						"uptime":                 float64(160),
					},
					time.Unix(0, 0),
				),
			},
		},
	}

	for _, tc := range tests {
		data, err := os.ReadFile("testdata/" + tc.filename)
		require.NoError(t, err)

		s := Suricata{
			Version: "2",
			Log:     testutil.Logger{},
		}
		acc := testutil.Accumulator{}
		require.NoError(t, s.parse(&acc, data))

		testutil.RequireMetricsEqual(t, tc.expected, acc.GetTelegrafMetrics(), testutil.IgnoreTime())
	}
}