#!/bin/sh

# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0.  If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.

set -e

SYSTEMTESTTOP=..
# shellcheck source=conf.sh
. "$SYSTEMTESTTOP/conf.sh"

count_rrsigs() (
  grep -c "IN[[:space:]]*RRSIG" "$@" || true
)

dig_with_opts() (
  $DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
)

dig_for_rr() (
  alg=$1
  rrtype=$2
  count0=$3
  dig_with_opts "$alg.example." @10.53.0.1 "$rrtype" >"dig.out.$rrtype.$alg" \
    && count=$(count_rrsigs "dig.out.$rrtype.$alg") \
    && test "$count" -gt "$count0"
)

test_done() {
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
  ret=0
}

status=0
ret=0

n=0
while read -r alg; do
  zonefile=ns1/$alg.example.db
  echo_i "testing PKCS#11 key generation ($alg)"
  count=$($PK11LIST | grep -c "pkcs11-$alg-ksk" || true)
  [ "$count" -eq 4 ] || ret=1
  test_done

  echo_i "testing offline signing with PKCS#11 keys ($alg)"

  count=$(grep -c "[0-9][[:space:]]*RRSIG" "$zonefile.signed")
  [ "$count" -eq 9 ] || ret=1
  test_done

  echo_i "testing inline signing with new PKCS#11 ZSK ($alg)"

  dig_with_opts "$alg.example." @10.53.0.1 "SOA" >"dig.out.SOA.$alg.0" || ret=1
  countSOA0=$(count_rrsigs "dig.out.SOA.$alg.0")
  new_zsk=$(grep -v ';' "ns1/$alg.zsk")

  cat >"upd.cmd.ZSK.$alg" <<EOF
server 10.53.0.1 $PORT
ttl 300
zone $alg.example.
update add $new_zsk
send
EOF

  $NSUPDATE -v >"upd.log.ZSK.$alg" <"upd.cmd.ZSK.$alg" || ret=1

  retry_quiet 20 dig_for_rr "$alg" "SOA" "$countSOA0" || ret=1
  test_done

  echo_i "testing inline signing with new PKCS#11 KSK ($alg)"

  dig_with_opts "$alg.example." @10.53.0.1 "DNSKEY" >"dig.out.DNSKEY.$alg.0" || ret=1
  countDNSKEY0=$(count_rrsigs "dig.out.DNSKEY.$alg.0")
  new_ksk=$(grep -v ';' "ns1/$alg.ksk")

  cat >"upd.cmd.KSK.$alg" <<EOF
server 10.53.0.1 $PORT
ttl 300
zone $alg.example.
update add $new_ksk
send
EOF

  $NSUPDATE -v >"upd.log.KSK.$alg" <"upd.cmd.KSK.$alg" || ret=1

  retry_quiet 20 dig_for_rr "$alg" "DNSKEY" "$countDNSKEY0" || ret=1
  test_done

  echo_i "testing PKCS#11 key destroy ($alg)"

  # Lookup all existing keys
  echo_i "looking up all existing keys ($alg)"
  $PK11LIST >"pkcs11-list.out.id.$alg" || ret=1
  test_done

  echo_i "destroying key with 'pkcs11-$alg-ksk1' label ($alg)"
  $PK11DEL -l "pkcs11-$alg-ksk1" >/dev/null 2>&1 || ret=1
  test_done

  echo_i "destroying key with 'pkcs11-$alg-zsk1' label ($alg)"
  $PK11DEL -l "pkcs11-$alg-zsk1" >/dev/null 2>&1 || ret=1
  test_done

  id=$(awk -v label="'pkcs11-$alg-ksk2'" '{ if ($7 == label) { print $9; exit; } }' <"pkcs11-list.out.id.$alg")
  echo_i "destroying key with $id id ($alg)"
  if [ -n "$id" ]; then
    $PK11DEL -i "$id" >/dev/null 2>&1 || ret=1
  else
    ret=1
  fi
  test_done

  id=$(awk -v label="'pkcs11-$alg-zsk2'" '{ if ($7 == label) { print $9; exit; } }' <"pkcs11-list.out.id.$alg")
  echo_i "destroying key with $id id ($alg)"
  if [ -n "$id" ]; then
    $PK11DEL -i "$id" >/dev/null 2>&1 || ret=1
  else
    ret=1
  fi
  test_done

  echo_i "checking if all keys have been destroyed ($alg)"
  $PK11LIST >"pkcs11-list.out.$alg" || ret=1
  count=$(grep -c "pkcs11-$alg-[kz]sk[0-9]*" "pkcs11-list.out.$alg" || true)
  [ "$count" -eq 0 ] || ret=1
  test_done
  n=$((n + 1))
done <supported

echo_i "Checking if all supported algorithms were tested"
[ "$n" -eq "$(wc -l <supported)" ] || ret=1
test_done

echo_i "Checking for assertion failure in pk11_numbits()"
$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
dig_with_opts @10.53.0.1 version.bind. CH TXT >dig.out.pk11_numbits || ret=1
test_done

echo_i "exit status: $status"
[ "$status" -eq 0 ] || exit 1