# SPDX-License-Identifier: GPL-3.0-or-later
"""Anti-rootkit cross-view tests — the pure diff cores plus a run() integration
test that injects each system view, so it needs no live /proc, /sys, or ss."""
import unittest

from enodia_sentinel import rootcheck
from enodia_sentinel.alert import Severity
from enodia_sentinel.config import Config
from enodia_sentinel.system import Socket, SystemState


class TestDiffCores(unittest.TestCase):
    def test_hidden_pids_are_alive_minus_visible(self):
        # 1337 is alive (kernel knows it) but absent from the /proc listing.
        self.assertEqual(
            rootcheck.find_hidden_pids({1, 2, 3}, {1, 2, 3, 1337}), {1337})

    def test_no_hidden_pids_when_views_agree(self):
        self.assertEqual(rootcheck.find_hidden_pids({1, 2}, {1, 2}), set())

    def test_hidden_modules_live_in_sys_but_not_proc(self):
        self.assertEqual(
            rootcheck.find_hidden_modules({"ext4", "nf_tables"},
                                          {"ext4", "nf_tables", "evil_rk"}),
            {"evil_rk"})

    def test_hidden_ports_in_procnet_not_in_ss(self):
        self.assertEqual(
            rootcheck.find_hidden_ports({22, 80, 31337}, {22, 80}), {31337})


class TestSsPortsFromState(unittest.TestCase):
    def test_extracts_listening_ports_from_injected_state(self):
        socks = [
            Socket("LISTEN", "0.0.0.0:22", "0.0.0.0:0", 10, "sshd", 1),
            Socket("LISTEN", "127.0.0.1:631", "0.0.0.0:0", 11, "cupsd", 2),
        ]
        state = SystemState(sockets=socks)
        self.assertEqual(rootcheck.ss_listen_ports(state), {22, 631})


class TestRunIntegration(unittest.TestCase):
    """Drive run() with every system view monkeypatched to a known state."""

    def setUp(self):
        self.cfg = Config()
        self._saved = {}
        for name in ("proc_pids", "alive_pids", "proc_modules",
                     "sys_live_modules", "procnet_listen_ports",
                     "promiscuous_interfaces"):
            self._saved[name] = getattr(rootcheck, name)

    def tearDown(self):
        for name, fn in self._saved.items():
            setattr(rootcheck, name, fn)

    def _patch(self, **views):
        rootcheck.proc_pids = lambda: views.get("proc_pids", set())
        rootcheck.alive_pids = lambda cap: views.get("alive_pids", set())
        rootcheck.proc_modules = lambda: views.get("proc_modules", set())
        rootcheck.sys_live_modules = lambda: views.get("sys_live_modules", set())
        rootcheck.procnet_listen_ports = lambda: views.get("procnet_ports", set())
        rootcheck.promiscuous_interfaces = lambda: views.get("promisc", [])

    def test_clean_system_yields_nothing(self):
        self._patch(proc_pids={1, 2}, alive_pids={1, 2},
                    proc_modules={"ext4"}, sys_live_modules={"ext4"})
        state = SystemState(sockets=[])
        self.assertEqual(list(rootcheck.run(self.cfg, state)), [])

    def test_hidden_module_and_port_and_promisc(self):
        self._patch(
            proc_pids={1}, alive_pids={1},
            proc_modules={"ext4"}, sys_live_modules={"ext4", "diamorphine"},
            procnet_ports={22, 31337}, promisc=["eth0"])
        state = SystemState(sockets=[
            Socket("LISTEN", "0.0.0.0:22", "0.0.0.0:0", 10, "sshd", 1)])
        alerts = {a.signature: a for a in rootcheck.run(self.cfg, state)}
        self.assertIn("rootkit_hidden_module", alerts)
        self.assertEqual(alerts["rootkit_hidden_module"].severity, Severity.CRITICAL)
        self.assertIn("diamorphine", alerts["rootkit_hidden_module"].detail)
        self.assertIn("rootkit_hidden_port", alerts)
        self.assertIn("31337", alerts["rootkit_hidden_port"].detail)
        self.assertIn("promiscuous_interface", alerts)
        self.assertEqual(alerts["promiscuous_interface"].sid, rootcheck.SID_PROMISC)


if __name__ == "__main__":
    unittest.main()