#! /bin/bash

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
# 
#   http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#


#===============================================================================
# These tests create federated links between two brokers using SASL security.
# The SASL mechanism used is EXTERNAL, which is satisfied by SSL
# transport-layer security.
#===============================================================================

source ./test_env.sh

script_name=`basename $0`

if [ $# -ne 1 ]
then
  echo
  # These are the four different ways of creating links ( or routes+links ) 
  # that the qpid-route command provides.
  echo "Usage: ${script_name} dynamic|link|queue|route"
  echo
  exit 1
fi

qpid_route_method=$1

debug=

function print {
  if [ "$debug" ]; then
    echo "${script_name}: $1"
  fi
}



# This minimum value corresponds to sasl version 2.1.22
minimum_sasl_version=131350

sasl_version=`$QPID_TEST_EXEC_DIR/sasl_version`

# This test is necessary because this sasl version is the first one that permits 
# redirection of the sasl config file path.
if [ "$sasl_version" -lt  "$minimum_sasl_version" ]; then
  echo "sasl_fed: must have sasl version 2.1.22 or greater.  ( Integer value: $minimum_sasl_version )  Version is: $sasl_version"
  exit 0
fi

# In a distribution, the python tools will be absent.
if [ ! -f $QPID_CONFIG_EXEC ] || [ ! -f $QPID_ROUTE_EXEC ] ; then
    echo "python tools absent - skipping sasl_fed_ex."
    exit 0
fi

CERT_DIR=`pwd`/test_cert_db
CERT_PW_FILE=`pwd`/cert.password
TEST_HOSTNAME=127.0.0.1

create_certs() {
    #create certificate and key databases with single, simple, self-signed certificate in it
    mkdir ${CERT_DIR}
    certutil -N -d ${CERT_DIR} -f ${CERT_PW_FILE}
    certutil -S -d ${CERT_DIR} -n ${TEST_HOSTNAME} -s "CN=${TEST_HOSTNAME}" -t "CT,," -x -f ${CERT_PW_FILE} -z /usr/bin/certutil 2> /dev/null
}

delete_certs() {
    if [[ -e ${CERT_DIR} ]] ;  then
        rm -rf ${CERT_DIR}
    fi
}


CERTUTIL=$(type -p certutil)
if [[ !(-x $CERTUTIL) ]] ; then
    echo "No certutil, skipping ssl test";
    exit 0;
fi

delete_certs
create_certs || error "Could not create test certificate"


sasl_config_file=$builddir/sasl_config

my_random_number=$RANDOM
tmp_root=/tmp/sasl_fed_$my_random_number
mkdir -p $tmp_root

SRC_SSL_PORT=6667
DST_SSL_PORT=6666

SRC_TCP_PORT=5801
DST_TCP_PORT=5807

SSL_LIB=../.libs/ssl.so

export QPID_SSL_CERT_NAME=${TEST_HOSTNAME}

export QPID_NO_MODULE_DIR=1
export QPID_LOAD_MODULE=$SSLCONNECTOR_LIB
export QPID_SSL_CERT_DB=${CERT_DIR}
export QPID_SSL_CERT_PASSWORD_FILE=${CERT_PW_FILE}
export QPID_SSL_CERT_NAME=${TEST_HOSTNAME}



#######################################
# Understanding this Plumbing
#######################################
#  1. when you establish the route with qpid-route,
#     here is the best termiology to use:
#
#        qpid-route route add  DST  SRC
#
#  2. DST will connect to SRC through the ssl port of SRC.
#
#  3. sender client connects to the tcp port of SRC.
#
#  4. sender specifies mechanism ANONYMOUS.
#
#  5. DST pulls messages off the temp queue on SRC to itself.
#



print "Starting SRC broker"
$QPIDD_EXEC                                  \
  --port=${SRC_TCP_PORT}                     \
  --ssl-port ${SRC_SSL_PORT}                 \
  --ssl-sasl-no-dict                         \
  --sasl-config=$sasl_config_file            \
  --ssl-require-client-authentication        \
  --auth yes                                 \
  --ssl-cert-db $CERT_DIR                    \
  --ssl-cert-password-file $CERT_PW_FILE     \
  --ssl-cert-name $TEST_HOSTNAME             \
  --no-data-dir                              \
  --no-module-dir                            \
  --load-module ${SSL_LIB}                   \
  --mgmt-enable=yes                          \
  --log-enable info+                         \
  --log-source yes                           \
  --daemon                                   \
  --log-to-file $tmp_root/qpidd_src.log 2> /dev/null


print "Starting DST broker"
$QPIDD_EXEC                                  \
  --port=${DST_TCP_PORT}                     \
  --ssl-port ${DST_SSL_PORT}                 \
  --ssl-cert-db $CERT_DIR                    \
  --ssl-cert-password-file $CERT_PW_FILE     \
  --ssl-cert-name $TEST_HOSTNAME             \
  --ssl-sasl-no-dict                         \
  --ssl-require-client-authentication        \
  --sasl-config=$sasl_config_file            \
  --no-data-dir                              \
  --no-module-dir                            \
  --load-module ${SSL_LIB}                   \
  --mgmt-enable=yes                          \
  --log-enable info+                         \
  --log-source yes                           \
  --daemon                                   \
  $COMMON_BROKER_OPTIONS                     \
  --log-to-file $tmp_root/qpidd_dst.log 2> /dev/null


# I am not randomizing these names, because this test creates its own brokers.
QUEUE_NAME=sasl_fed_queue
ROUTING_KEY=sasl_fed_queue
EXCHANGE_NAME=sasl_fedex


print "add exchanges"
$QPID_CONFIG_EXEC -a localhost:${SRC_TCP_PORT} add exchange direct $EXCHANGE_NAME
$QPID_CONFIG_EXEC -a localhost:${DST_TCP_PORT} add exchange direct $EXCHANGE_NAME


print "add queues"
$QPID_CONFIG_EXEC -a localhost:${SRC_TCP_PORT} add queue $QUEUE_NAME
$QPID_CONFIG_EXEC -a localhost:${DST_TCP_PORT} add queue $QUEUE_NAME


print "create bindings"
$QPID_CONFIG_EXEC -a localhost:${SRC_TCP_PORT} bind $EXCHANGE_NAME $QUEUE_NAME $ROUTING_KEY
$QPID_CONFIG_EXEC -a localhost:${DST_TCP_PORT} bind $EXCHANGE_NAME $QUEUE_NAME $ROUTING_KEY


#
# NOTE: The SRC broker *must* be referred to as $TEST_HOSTNAME, and not as "localhost".
#       It must be referred to by the exact string given as the Common Name (CN) in the cert,
#       which was created in the function create_certs, above.



if   [ ${qpid_route_method} == "dynamic" ]; then
  print "dynamic add"
  $QPID_ROUTE_EXEC -t ssl dynamic add localhost:${DST_TCP_PORT} $TEST_HOSTNAME:${SRC_SSL_PORT} $EXCHANGE_NAME "" "" EXTERNAL
elif [ ${qpid_route_method} == "link"   ];  then
  print "link add"
  $QPID_ROUTE_EXEC -t ssl link add localhost:${DST_TCP_PORT} $TEST_HOSTNAME:${SRC_SSL_PORT}  EXTERNAL
elif [ ${qpid_route_method} == "queue" ];   then
  print "queue add"
  $QPID_ROUTE_EXEC -t ssl queue add localhost:${DST_TCP_PORT}   $TEST_HOSTNAME:${SRC_SSL_PORT} $EXCHANGE_NAME $ROUTING_KEY EXTERNAL
elif [ ${qpid_route_method} == "route" ];   then
  print "route add"
  $QPID_ROUTE_EXEC -t ssl route add localhost:${DST_TCP_PORT}   $TEST_HOSTNAME:${SRC_SSL_PORT} $EXCHANGE_NAME $ROUTING_KEY "" "" EXTERNAL
else
  echo "unknown method: |${qpid_route_method}|"
  echo " choices are: dynamic|link|queue|route "
  print "Asking brokers to quit."
  $QPIDD_EXEC --port ${SRC_TCP_PORT} --quit
  $QPIDD_EXEC --port ${DST_TCP_PORT} --quit
  exit 2
fi

# I don't know how to avoid this sleep yet.  It has to come after route-creation 
# to avoid false negatives.
sleep 5

print "check the link"
link_status=$($QPID_ROUTE_EXEC link list localhost:${DST_TCP_PORT} | tail -1 | awk '{print $5}')
print "link_status == ${link_status}"


print "Asking brokers to quit."
$QPIDD_EXEC --port ${SRC_TCP_PORT} --quit
$QPIDD_EXEC --port ${DST_TCP_PORT} --quit

sleep 1

print "Removing temporary directory $tmp_root"
rm -rf $tmp_root


if [ ${link_status} == "Operational" ]; then
  print "result: good"
  exit 0
fi

print "result: fail"
exit 3