crdhcpc 0.1.1

//! DHCP Client Configuration

use serde::{Deserialize, Serialize};
use std::net::IpAddr;

/// Main DHCP client configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct DhcpClientConfig {
    /// Enable DHCP client
    pub enabled: bool,

    /// Interfaces to run DHCP client on
    pub interfaces: Vec<String>,

    /// Mock mode (for testing)
    pub mock_mode: bool,

    /// DHCPv4 configuration
    pub dhcpv4: Dhcpv4Config,

    /// DHCPv6 configuration
    pub dhcpv6: Dhcpv6Config,

    /// PXE configuration
    pub pxe: PxeConfigSettings,

    /// Dynamic DNS configuration
    pub ddns: DdnsConfig,

    /// TFTP configuration
    pub tftp: TftpConfig,

    /// Failover configuration
    pub failover: FailoverConfig,

    /// Security configuration
    pub security: SecurityConfig,

    /// WiFi configuration (per-interface)
    pub wifi: WifiInterfaceConfig,
}

impl Default for DhcpClientConfig {
    fn default() -> Self {
        Self {
            enabled: true,
            interfaces: vec!["eth0".to_string()],
            mock_mode: false,
            dhcpv4: Dhcpv4Config::default(),
            dhcpv6: Dhcpv6Config::default(),
            pxe: PxeConfigSettings::default(),
            ddns: DdnsConfig::default(),
            tftp: TftpConfig::default(),
            failover: FailoverConfig::default(),
            security: SecurityConfig::default(),
            wifi: WifiInterfaceConfig::default(),
        }
    }
}

/// DHCPv4 configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct Dhcpv4Config {
    pub enabled: bool,
    pub hostname: Option<String>,
    pub send_hostname: bool,
    pub vendor_class: Option<String>,
    pub request_options: Vec<u8>,
    pub timeout: u64, // seconds
    pub retry_count: u32,
}

impl Default for Dhcpv4Config {
    fn default() -> Self {
        Self {
            enabled: true,
            hostname: None,
            send_hostname: true,
            vendor_class: Some("crrouter-web".to_string()),
            request_options: vec![1, 3, 6, 15, 28, 42], // subnet mask, router, DNS, domain, broadcast, NTP
            timeout: 10,
            retry_count: 3,
        }
    }
}

/// DHCPv6 configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct Dhcpv6Config {
    pub enabled: bool,
    pub request_options: Vec<u16>,
    pub prefix_delegation: bool,
    pub rapid_commit: bool,
    pub timeout: u64, // seconds
    pub retry_count: u32,
    /// Authentication configuration (RFC 8415 Section 20)
    pub authentication: Dhcpv6AuthConfig,
    /// TLS/STARTTLS configuration (RFC 7653)
    pub tls: Dhcpv6TlsConfig,
}

impl Default for Dhcpv6Config {
    fn default() -> Self {
        Self {
            enabled: false,
            request_options: vec![23, 24], // DNS servers, domain search list
            prefix_delegation: true,
            rapid_commit: false,
            timeout: 10,
            retry_count: 3,
            authentication: Dhcpv6AuthConfig::default(),
            tls: Dhcpv6TlsConfig::default(),
        }
    }
}

/// DHCPv6 TLS/STARTTLS Configuration (RFC 7653)
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct Dhcpv6TlsConfig {
    /// Enable TLS support (STARTTLS)
    pub enabled: bool,
    /// Use TCP instead of UDP (required for STARTTLS)
    pub use_tcp: bool,
    /// Require TLS (fail if STARTTLS not supported by server)
    pub require_tls: bool,
    /// Verify server certificate
    pub verify_server: bool,
    /// Server name for SNI (Server Name Indication)
    pub server_name: Option<String>,
    /// Path to CA certificate file (PEM format)
    pub ca_cert: Option<String>,
    /// Path to client certificate file (PEM format) for mutual TLS
    pub client_cert: Option<String>,
    /// Path to client private key file (PEM format)
    pub client_key: Option<String>,
    /// Minimum TLS version: "1.2" or "1.3"
    pub min_version: String,
    /// TCP port for DHCPv6 over TCP (default: 547)
    pub tcp_port: u16,
}

impl Default for Dhcpv6TlsConfig {
    fn default() -> Self {
        Self {
            enabled: false,
            use_tcp: false,
            require_tls: false,
            verify_server: true,
            server_name: None,
            ca_cert: None,
            client_cert: None,
            client_key: None,
            min_version: "1.2".to_string(),
            tcp_port: 547,
        }
    }
}

/// DHCPv6 Authentication Configuration (RFC 8415 Section 20)
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct Dhcpv6AuthConfig {
    /// Enable authentication
    pub enabled: bool,
    /// Authentication protocol
    /// - "delayed": Delayed Authentication (RFC 3315)
    /// - "reconfigure-key": Reconfigure Key Authentication
    pub protocol: String,
    /// Authentication algorithm
    /// - "hmac-sha256": HMAC-SHA256 (recommended)
    /// - "hmac-sha1": HMAC-SHA1
    /// - "hmac-md5": HMAC-MD5 (deprecated, not recommended)
    pub algorithm: String,
    /// Pre-shared key (hex-encoded or base64)
    pub key: Option<String>,
    /// Key ID for key lookup
    pub key_id: Option<u32>,
    /// Realm for delayed authentication
    pub realm: Option<String>,
    /// Require authentication on all server messages
    pub require_server_auth: bool,
    /// Accept messages without authentication (fallback mode)
    pub accept_unauthenticated: bool,
}

impl Default for Dhcpv6AuthConfig {
    fn default() -> Self {
        Self {
            enabled: false,
            protocol: "delayed".to_string(),
            algorithm: "hmac-sha256".to_string(),
            key: None,
            key_id: None,
            realm: None,
            require_server_auth: false,
            accept_unauthenticated: true,
        }
    }
}

/// PXE configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct PxeConfigSettings {
    pub enabled: bool,
    pub vendor_class: String,
    pub architecture: u16, // 0x0000 = x86 BIOS, 0x0007 = x64 UEFI, 0x0009 = x64 UEFI HTTP
}

impl Default for PxeConfigSettings {
    fn default() -> Self {
        Self {
            enabled: false,
            vendor_class: "PXEClient".to_string(),
            architecture: 0x0007, // x64 UEFI
        }
    }
}

/// Dynamic DNS configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct DdnsConfig {
    pub enabled: bool,
    pub update_forward: bool,
    pub update_reverse: bool,
    pub ttl: u32,
    pub server: Option<String>,
    pub tsig_key_name: Option<String>,
    pub tsig_key: Option<String>,
}

impl Default for DdnsConfig {
    fn default() -> Self {
        Self {
            enabled: false,
            update_forward: true,
            update_reverse: true,
            ttl: 3600,
            server: None, // Use server from DHCP if not specified
            tsig_key_name: None,
            tsig_key: None,
        }
    }
}

/// TFTP configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct TftpConfig {
    pub enabled: bool,
    pub timeout: u64, // seconds
    pub max_retries: u32,
    pub block_size: u16,
}

impl Default for TftpConfig {
    fn default() -> Self {
        Self {
            enabled: false,
            timeout: 5,
            max_retries: 3,
            block_size: 1468, // Maximum for Ethernet without fragmentation
        }
    }
}

/// Failover configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct FailoverConfig {
    pub enabled: bool,
    pub server_timeout: u64, // seconds
    pub health_check_interval: u64, // seconds
    pub allowed_servers: Vec<IpAddr>,
    pub prefer_previous_server: bool,
}

impl Default for FailoverConfig {
    fn default() -> Self {
        Self {
            enabled: false,
            server_timeout: 5,
            health_check_interval: 30,
            allowed_servers: Vec::new(),
            prefer_previous_server: true,
        }
    }
}

/// WiFi interface configuration (mapping interfaces to networks)
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct WifiInterfaceConfig {
    /// Auto-connect to WiFi before DHCP
    pub auto_connect: bool,

    /// WiFi networks configuration per interface
    /// Example: { "wlan0": WifiNetworkConfig { ssid: "MyNetwork", ... } }
    pub networks: std::collections::HashMap<String, WifiNetworkConfig>,
}

impl Default for WifiInterfaceConfig {
    fn default() -> Self {
        Self {
            auto_connect: true,
            networks: std::collections::HashMap::new(),
        }
    }
}

/// WiFi network configuration for a specific interface
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct WifiNetworkConfig {
    /// Network SSID
    pub ssid: String,

    /// WiFi security type: "open", "wep", "wpa", "wpa2", "wpa3"
    pub security: String,

    /// Passphrase/password (for WPA/WPA2/WPA3)
    pub passphrase: Option<String>,

    /// WEP key (for WEP - deprecated)
    pub wep_key: Option<String>,

    /// Enterprise identity (for WPA Enterprise)
    pub identity: Option<String>,

    /// Enterprise password (for WPA Enterprise)
    pub password: Option<String>,

    /// CA certificate path (for WPA Enterprise)
    pub ca_cert: Option<String>,

    /// Hidden network (doesn't broadcast SSID)
    pub hidden: bool,

    /// Connection timeout in seconds
    pub timeout: u64,
}

impl Default for WifiNetworkConfig {
    fn default() -> Self {
        Self {
            ssid: String::new(),
            security: "wpa2".to_string(),
            passphrase: None,
            wep_key: None,
            identity: None,
            password: None,
            ca_cert: None,
            hidden: false,
            timeout: 30,
        }
    }
}

/// Security configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct SecurityConfig {
    pub validate_messages: bool,
    pub validate_options: bool,
    pub validate_server: bool,
    pub allowed_servers: Vec<IpAddr>,
    pub max_request_rate: u32, // requests per second
    pub enable_dhcp_snooping: bool,
    pub min_lease_time: u32, // seconds
    pub max_lease_time: u32, // seconds
}

impl Default for SecurityConfig {
    fn default() -> Self {
        Self {
            validate_messages: true,
            validate_options: true,
            validate_server: false,
            allowed_servers: Vec::new(),
            max_request_rate: 10,
            enable_dhcp_snooping: false,
            min_lease_time: 300, // 5 minutes
            max_lease_time: 86400 * 7, // 7 days
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_default_config() {
        let config = DhcpClientConfig::default();
        assert!(config.enabled);
        assert!(config.dhcpv4.enabled);
        assert!(!config.dhcpv6.enabled);  // Disabled by default for simpler setup
        assert!(!config.pxe.enabled);
        assert!(!config.ddns.enabled);    // Disabled by default
        assert!(!config.tftp.enabled);
        assert!(!config.failover.enabled); // Disabled by default
    }

    #[test]
    fn test_security_config() {
        let config = SecurityConfig::default();
        assert!(config.validate_messages);
        assert!(config.validate_options);
        assert_eq!(config.max_request_rate, 10);
        assert_eq!(config.min_lease_time, 300);
    }
}